← Back to index

DOM-based test cases — new Function(...)

High: 0 Medium: 0 Low: 0 Safe: 0 Total: 0

The Function constructor evaluates string arguments as full scripts. These fixtures combine inline and external triggers for security testing.

Use query payload

Inline scenarios

INLINE-1 (High): Query/hash → new Function()
// inline-script[#1]
(function(){
  function execute(payload) {
    if (!payload) return;
    functionConstructorSink(payload, 'inline-log');
  }
  const params = new URLSearchParams(location.search);
  if (params.has('payload')) execute(params.get('payload'));
})();
Execution log will appear here.
INLINE-2 (High): Field value → new Function()
// inline-script[#2]
function inlineFunctionConstructor(fieldId, logId) {
  const el = document.getElementById(fieldId);
  if (!el) return;
  functionConstructorSink(el.value, logId);
}
INLINE-3 (High):location.hash
// inline-script[#3]
(function() {
  function execute(payload) {
    if (!payload) return;
    var fn = new Function(payload);
    fn();
  }
  if (location.hash) {
    try {
      execute(decodeURIComponent(location.hash.slice(1)));
    } catch (err) {
      execute(location.hash.slice(1));
    }
  }
})();
Safe allowlist log…

External scenarios (click to run)

Insecure sets : user-controlled values, weak attributes
onclick="extFunctionConstructorFromHash()"
onclick="extFunctionConstructorFromSearch()"
onclick="extFunctionConstructorFromWindowName()"
onclick="extFunctionConstructorFromReferrer()"
onclick="extFunctionConstructorFromCookie()"
onclick="extFunctionConstructorFromLocalStorage()"
onclick="extFunctionConstructorFromSessionStorage()"