Controlled test site Client-side JavaScript security indicators

TC-007 - I2 String-to-code evaluation

setTimeout with string argument

positive / contextual SQ1SQ2SQ3

Context profile

A restrictive Content Security Policy is present. Session-like cookies use HttpOnly, Secure and SameSite.

Content Security Policy

default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'; font-src 'self'; object-src 'none'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'

Cookies

CookieTypeHttpOnlySecureSameSite
tc_sessionsession-likeyesyesStrict

Cookie values are placeholders and are never collected. Of these attributes only HttpOnly decides whether JavaScript can read the cookie.

Test case

The script reads the input query parameter from location.search and passes it to setTimeout as a string. When the timer fires the browser evaluates that string as JavaScript - the string form of a timer is string-to-code evaluation. Only this string form is in scope for I2; the callback form (TC-008) is not.

Example runs

Query parameter

input = alert(document.cookie)

Script output

What to observe

  • Write to the page shows that the string ran as code under C0: the timer evaluated it and updated the output.
  • alert(document.cookie) and Cookie exfiltration behave as in the eval case (TC-005): under C0 they run after the timer; the cookie is a placeholder and attacker.example is non-routable.
  • Under C1 the restrictive CSP without unsafe-eval blocks the string form of setTimeout, just like eval, so nothing runs (CSP violation in the console).

The static finding is on setTimeout with a string argument. The context decides the runtime impact, exactly as for eval. TC-008 pairs with this case: a callback argument is not treated as string-to-code.

Expected outcome

Purpose
Check that timer APIs are treated as I2 only when they execute a string as code.
Expected finding
Finding on setTimeout with a string argument.
Expected interpretation
Technically relevant string-to-code indicator; priority depends on whether the string is attacker-controlled and whether CSP allows or blocks string-to-code execution.
Expected priority
Low to medium (C1)
Notes
Operationalises the deliberate scope boundary of I2.

Expected priority is shown for the active context profile. Other profiles for this case: C0, C1.