Controlled test site Client-side JavaScript security indicators

Indicators
I4

I4 - source

URL-derived input

A common way for attacker-controllable data to enter browser JavaScript. Weak on its own, stronger near a dangerous sink.

TC-014 - positive / contextual Reading from location.hash near a DOM sink Check whether URL-derived input becomes visible as a source when it appears near a dangerous sink. C0C1
TC-015 - lower-risk / ambiguous Reading from window.location.href for routing Check how ordinary routing or state logic with URL-derived input is interpreted. single run
TC-016 - negative Navigation without a URL source Check that ordinary navigation or UI code without a supported URL-derived source does not produce an I4 finding. single run

Test pages for the proof-of-concept evaluation.