← Back to index

DOM clobbering

Tainted ids/names that can shadow globals through element attributes.

INLINE-1 (High): hash → form.name
const nameValue = location.hash;
const form = document.createElement('form');
form.name = nameValue;
document.body.appendChild(form);