Cookie mutations, leakage vectors, and safe configurations across inline and external scripts.
document.write / writelnDirect writes, cross-source payloads, dynamic wrappers, and delegated event handlers.
innerHTMLInline cases plus external triggers for DOM sources, storage, and template-style builders.
insertAdjacentHTMLCoverage for positional inserts, storage sources, and delegated handlers feeding raw markup.
appendChildDemonstrates DOM node construction from untrusted strings and safer text-node alternatives.
eval familyClassic eval, storage-driven payloads, string wrappers, and allowlisted JSON execution.
new Function()Function constructor flows from multiple sources, builder patterns, and structured safe handling.
Exercises every javascript-injection-taint sink: string timers, execScript, jQuery globalEval/getScript, execCommand, createContextualFragment, crypto.generateCRMFRequest, and script.text.
Open redirect sink with optional navigation, URL builders, and allowlist-focused mitigations.
Anchor href tampering, delegated setters, storage sources, and safe allowlisted normalisation.
postMessage usage, origin validation pitfalls, wildcard targetOrigin, and structured payload hardening.
CSS selector taint flows, wildcard postMessage helpers, weak origin checks, and escaped allow-list examples.
eval-based JSON parsing, WebSQL concatenation, XPath with raw user input, plus safe validation patterns.
XHR header manipulation, wildcard postMessage listeners, and header allow-list examples.
formAction/target/method/value/placeholder, style/cssText/background*, document.title, history state, createHTMLDocument.
Comment and string literals containing fake secrets to test token-detection rules and heuristics.
Fetch handlers writing attacker-controlled requests into caches and redirecting with untrusted URLs.
Dynamic templates compiled from tainted sources and injected into the DOM.
Tokens sourced from URL/cookies written to storage and headers without validation.
Untrusted data persisted into localStorage/sessionStorage/IndexedDB sinks.
Client-side prototype mutation via untrusted data flowing into __proto__/setPrototypeOf/assign.
id/name collisions crafted through tainted HTML/attributes to shadow globals.