Controlled test site Client-side JavaScript security indicators

TC-014 - I4 URL-derived input

Reading from location.hash near a DOM sink

positive / contextual I1 supporting SQ1SQ2SQ3

Context profile

A restrictive Content Security Policy is present. Session-like cookies use HttpOnly, Secure and SameSite.

Content Security Policy

default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'; font-src 'self'; object-src 'none'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'

Cookies

CookieTypeHttpOnlySecureSameSite
tc_sessionsession-likeyesyesStrict

Cookie values are placeholders and are never collected. Of these attributes only HttpOnly decides whether JavaScript can read the cookie.

Test case

The script reads the URL fragment from location.hash and assigns it to innerHTML. URL-derived input (I4) reaches an HTML-parsing sink (I1) - source and sink together, which is a stronger signal than either alone.

The payload lives in the fragment, after #. Changing only the fragment does not reload the page, so the value is re-read on hashchange - the same pattern a hash-router uses. The raw fragment (source) and the rendered result (sink) are shown below.

Example runs

Value from location.hash (raw)

Rendered via innerHTML

What to observe

  • HTML markup from the fragment is parsed - the word renders bold, because innerHTML interprets the fragment as HTML.
  • alert(document.cookie) and Cookie exfiltration run under C0 (an alert, or a request to attacker.example in the Network tab); the cookie is a placeholder and the domain is non-routable.
  • Under C1 the markup is still parsed but the CSP blocks the inline handler, so nothing runs.

Two findings are expected - the location.hash read and the innerHTML write - and their co-occurrence is the point: URL input reaching an HTML-parsing sink is a stronger signal than an isolated source (TC-015) or an isolated sink.

Expected outcome

Purpose
Check whether URL-derived input becomes visible as a source when it appears near a dangerous sink.
Expected finding
Finding on URL-derived input and finding on innerHTML.
Expected interpretation
Stronger signal than an isolated URL read or isolated DOM sink, because source and sink occur together.
Expected priority
Medium (C1)
Notes
Main case for the source-sink relationship between I4 and I1.

Expected priority is shown for the active context profile. Other profiles for this case: C0, C1.