TC-006 - I2 String-to-code evaluation

new Function with URL input

positive / contextual I4 supporting SQ1SQ2

Context profile

A restrictive Content Security Policy is present. Session-like cookies use HttpOnly, Secure and SameSite.

Content Security Policy

default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'; font-src 'self'; object-src 'none'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'

Cookie	Type	HttpOnly	Secure	SameSite
`tc_session`	session-like	yes	yes	Strict

Cookie values are placeholders and are never collected. Of these attributes only HttpOnly decides whether JavaScript can read the cookie.

Test case

The script reads the input query parameter from location.search and uses it to build the body of a function through new Function(...), which turns the string into executable code. The value is code, not HTML.

Example runs

Query parameter

No input parameter in the URL.

Script output

What to observe

Arithmetic shows new Function returned: 42 under C0 - the string was compiled into a function and executed.
Read document.cookie returns the JavaScript-readable cookie under C0, just as in the eval case.
alert(document.cookie) and Cookie exfiltration run under C0 (an alert, or a request to attacker.example in the Network tab); the cookie is a placeholder and the domain is non-routable.
Under C1 the restrictive CSP without unsafe-eval blocks the Function constructor, so it throws EvalError (visible in the console) and nothing runs.

The static finding is on the new Function call. It is kept as a separate test case from eval (TC-005) so each string-to-code API can be evaluated independently, even though their context sensitivity is the same.

Expected outcome

Purpose: Check whether the Function constructor is reported as string-to-code evaluation.
Expected finding: Finding on new Function; where AST context is available, it should also show the nearby URL source.
Expected interpretation: Possible code-injection indicator; relevance depends on input control and CSP unsafe-eval.
Expected priority: Medium (C1)
Notes: Kept separate from TC-005 so that eval and new Function can be evaluated independently.

Expected priority is shown for the active context profile. Other profiles for this case: C0, C1.