TC-016 - I4 URL-derived input

Navigation without a URL source

negative SQ1

Context profile

Single run. Browser context is not decisive for this test case, so no context profile is applied.

Content Security Policy

No Content-Security-Policy header is sent.

No cookies are set by this page.

Test case

The page navigates through static links. The script highlights the current section, but derives "current" from a hardcoded constant - it reads no URL source: no location.hash, document.location or window.location.href.

What to observe

The I4 test cases link is marked as current. A naive menu would read window.location.href to decide that; this script instead compares against a fixed constant (/i4), so no URL is read.
The links themselves are plain <a href> elements with fixed destinations. Navigation needs no JavaScript at all.

No I4 finding is expected. This is the negative control: it makes over-reporting visible if a rule flags navigation or menu code that never actually reads a URL property.

Expected outcome

Purpose: Check that ordinary navigation or UI code without a supported URL-derived source does not produce an I4 finding.
Expected finding: No I4 finding.
Expected interpretation: No URL-derived input indicator.
Expected priority: None (single run)
Notes: Negative control for I4.