TC-015 - I4 URL-derived input
Reading from window.location.href for routing
lower-risk / ambiguous SQ1SQ3
Context profile
Single run. Browser context is not decisive for this test case, so no context profile is applied.
Content Security Policy
No Content-Security-Policy header is sent.
Cookies
No cookies are set by this page.
Test case
The script reads window.location.href and derives the current path from it - the kind
of thing routing or state logic does. There is no dangerous sink: the value is only shown as text.
Script output
What to observe
- The URL is read (
window.location.href), but only used to display the current path. Nothing is written to a DOM sink or evaluated as code. - This is a correct I4 finding: a URL source is read. But on its own it is low-risk, because no dangerous consumption is visible.
This case documents the expected over-reporting of I4: reading the URL is normal behaviour in many applications. The signal only becomes concerning when URL input reaches a sink, as in TC-014.
Expected outcome
- Purpose
- Check how ordinary routing or state logic with URL-derived input is interpreted.
- Expected finding
- Finding on window.location.href.
- Expected interpretation
- Technically correct source indicator, but lower-risk because no dangerous consumption is visible.
- Expected priority
- Low (single run)
- Notes
- Documents the expected over-reporting of I4.