Scenarios cover WebSQL, JSON.parse/eval, and XPath helpers that become injectable when driven by attacker strings.
Buttons exercise the same helpers with safe validation to contrast behaviour.
Logs will appear here.
CI-H1 (High): WebSQL query built via string concatenation from location.hash
// inline-script[#1]
(function(){
var name = location.hash ? decodeURIComponent(location.hash.slice(1)) : '';
tx.executeSql("SELECT * FROM users WHERE name='" + name + "'", [], function(){}, onSqlError);
})();
CI-H3 (High): XPath expression built from tainted selector
// inline-script[#3]
function runTaintedXPath(input) {
var expr = "//user[name='" + input + "']";
document.evaluate(expr, document, null, XPathResult.ANY_TYPE, null);
}
runTaintedXPath(getLocationSearch());
CI-H4 (High): Parsed JSON controls selectors and payload
// inline-script[#4]
function applyJsonSelector(jsonText) {
try {
var data = JSON.parse(jsonText);
} catch (err) {
console.warn('JSON parse error', err);
}
}
applyJsonSelector(getLocationSearch())
CI-H5 (High): Any call to executeSql should be reviewed
// inline-script[#5]
function runQuery(query, params) {
tx.executeSql(query, params || []);
}
runQuery(getLocationSearch(), []);