DOM-based test cases — DOM data manipulation sinks

// inline-script[#1]
function inlineRewriteFormMetadata() {
  const form = document.getElementById('inline-profile-form');
  const input = document.getElementById('inline-profile-input');
  const submitBtn = document.getElementById('inline-submit-btn');
  const destField = document.getElementById('inline-user-url');
  const methodField = document.getElementById('inline-method-source');
  const placeholderField = document.getElementById('inline-placeholder-source');

  const dest = destField.value || location.hash.slice(1) || getCookieByName('ptk_dest') || '/api/profile';
  const method = methodField.value || new URLSearchParams(location.search).get('method') || 'post';
  const placeholder = placeholderField.value || window.name || 'Enter value';
  const storedPayload = sessionStorage.getItem('profilePayload') || document.cookie || 'stored=value';

  form.target = window.name || '_self';
  form.method = method;
  input.value = storedPayload;
  input.placeholder = placeholder;
  submitBtn.formAction = `${dest}?submit=1`;
}
inlineRewriteFormMetadata();

// inline-script[#2]
function inlineApplyTaintedStyles() {
  const button = document.getElementById('inline-style-button');
  const card = document.getElementById('inline-themed-card');
  const cssField = document.getElementById('inline-style-source');
  const imageField = document.getElementById('inline-style-image');
  const storedButtonStyle = localStorage.getItem('buttonStyle');
  const storedCardCss = localStorage.getItem('cardCss');

  button.setAttribute('style', cssField.value || storedButtonStyle || "background:#444;color:#fff;");
  card.style.cssText = storedCardCss || "background:#fee;border:2px dashed #c00;padding:1rem;";
  card.style.backgroundImage = `url(${imageField.value || location.hash.slice(1) || window.name })`;
}
inlineApplyTaintedStyles();

// inline-script[#3]
function inlineMutateHistory(run = false) {
  if (!run) return;
  const sourceField = document.getElementById('inline-history-source');
  const payload = sourceField.value || document.cookie || location.hash.slice(1) || "history-demo";

  history.pushState({ jump: payload }, payload, payload);
  document.title = payload;
  document.implementation.createHTMLDocument(payload);
}
inlineMutateHistory(false);