DOM-based test cases — Ajax request header manipulation

High: 0 Medium: 0 Safe: 0 Total: 0

Scenarios highlight unsafe ways to construct Ajax requests: copying attacker data into headers, evaluating payloads, and wiring postMessage listeners without origin checks. Safe cards show header name/value allow-lists prior to issuing requests.

Logs will appear here.

High severity — direct header manipulation

ARH-H1 (High): location.hash copied into setRequestHeader

// inline-script[#1]
(function(){
  var sel = location.hash ? decodeURIComponent(location.hash.slice(1)) : '';
  var xhr = new XMLHttpRequest();
  xhr.open('POST', '/api/log');
  xhr.setRequestHeader('X-From-Hash', sel);
})();

ARH-H2 (High): Copying document.cookie into custom header for fetch()

// inline-script[#2]
fetch('/api/echo', {
  method: 'POST',
  headers: {
    'Cookie': document.cookie
  }
});

ARH-H3 (High): $.globalEval of tainted payload before XHR.send()

// inline-script[#3]
(function(evt){
  var payload = evt.data;
  $.globalEval(payload);
  var xhr = new XMLHttpRequest();
  xhr.open('POST', '/api/forward');
  xhr.send(payload);
})({"data": document.cookie});

Medium severity — weak validation & listeners

ARH-M1 (Medium): postMessage listener building headers without origin check

// inline-script[#4]
 (function(evt) {
  var data = evt.data || {};
  var xhr = new XMLHttpRequest();
  xhr.open('POST', '/api/message');
  if (data && data.header) xhr.setRequestHeader(data.header, data.value || '1');
  xhr.send('sink');
})({"data": window.name});

ARH-M2 (Medium): XMLHttpRequest.open fed with tainted URL param

// inline-script[#5]
(function(){
  var qs = new URLSearchParams(location.search);
  var url = qs.get('redir') || '/api/data';
  var xhr = new XMLHttpRequest();
  xhr.open('GET', url, true);
  xhr.send();
})();

Safe scenarios — header name/value validation

ARH-S1 (Safe): header name allow-list & regex validation

// inline-script[#6]
const allowedHeaders = ['X-Trace', 'X-Debug'];
function sendSafeHeader(name, value) {
  if (!allowedHeaders.includes(name)) return;
  if (!/^[-a-z0-9]{1,32}$/i.test(value)) return;
  var xhr = new XMLHttpRequest();
  xhr.open('POST', '/api/safe');
  xhr.setRequestHeader(name, value);
  xhr.send('ok');
}