DOM-based test cases — document.write / writeln

This page mixes inline and external test cases. External scripts don’t auto-run to avoid page replacement; trigger them with buttons.

INLINE-1 (High): direct hash → write (vuln)

// inline-script[#1]
document.write(location.hash);

INLINE-2 (High): decoded hash → write (vuln)

// inline-script[#2]
document.write(decodeURIComponent(location.hash.slice(1)));

INLINE-3 (High): aliasing from query → writeln (vuln)

// inline-script[#3]
var q = location.search.substring(1);
q = decodeURIComponent(q);
document.writeln(q);

INLINE-4 (High): helper propagator (vuln)

// inline-script[#4]
function id(v){ return v; }
var s = location.hash.slice(1);
document.write(id(s));

INLINE-5: sanitized via DOMPurify.sanitize (safe if sanitizer effective)

// inline-script[#5]
document.write(DOMPurify.sanitize(location.hash.slice(1)));

INLINE-6 (High): concat + template literal (vuln)

// inline-script[#7]
var name = new URLSearchParams(location.search).get('name') || 'Guest';
document.write('Hello ' + name + '');
document.writeln(`${name}
`);

INLINE-7 (High): string-eval → write (vuln) — click to run

// inline-script[#8] (gated)
function runInlineSetTimeoutEval() {
  var p = location.hash.slice(1);
  setTimeout("document.write('INLINE-SETTIMEOUT: ' + '" + p + "')", 10);
}

INLINE-8(High): document.addEventListener with extWriteFromInput

// inline-script[#8] (gated)
document.addEventListener('click', function(e){
  var t = e && e.target;
  if (t && t.matches && t.matches('.ext-write-button')) {
    var id = t.getAttribute('data-field');
    extWriteFromInput(id);
  }
});

DOM-based test cases — `document.write` / `writeln`

Inline cases

External cases (click to run)