← Back to index

DOM-based test cases — document.cookie security

High: 7 Medium: 0 Low: 7 Safe: 1 Total: 15

This page contains **cookie manipulation** scenarios only: insecure attributes, user-controlled values, over-permissive scope, deletion patterns, and leakage. There are no HTML sinks here (no document.write/innerHTML). Taint/exfil flows are normalised to High; configuration/hygiene issues default to Low; sanitised examples are marked Safe.

Inline scenarios

Element value
INLINE-1 (High): Set cookie from user-controlled location.hash without attributes
// inline-script[#1]
(function(){
  var v = location.hash ? location.hash.slice(1) : '';
  document.cookie = "ptk_from_hash=" + v + "; path=/";
})();
INLINE-2 (High): Set cookie from location.search with SameSite=None but missing Secure
// inline-script[#2]
(function(){
  var q = location.search ? location.search.substring(1) : '';
  document.cookie = "ptk_from_query=" + q + "; Path=/; SameSite=None";
})();
INLINE-3 (High): External source and inline sink
// inline-script[#3]
(function(){
  var value = getLocationHash();
  document.cookie = value;
})();
INLINE-4 (High): External source and external sink
// inline-script[#4]
(function(){
  var value = getElementValue('element');
  setCookie(value);
})();
INLINE-5 (Safe): Proper attributes + encoded value
// inline-script[#5]
(function(){
  var val = encodeURIComponent("safe-value");
  document.cookie = "ptk_safe=" + val + "; Path=/; Secure; SameSite=Strict";
})();

External scenarios (click to run)

Insecure sets : user-controlled values, weak attributes
onclick="runCookieFromHashNoAttrs()"
onclick="javascript:document.cookie = getLocationSearch();"
onclick="setCookieString(getElementValue('element'));"