DOM-based test cases

Inline scenarios run automatically; external scenarios are triggered manually so you can attach breakpoints or observe the DOM mutations.

INLINE-1 (High): Auto-run from query/hash into innerHTML

// inline-script[#1]
(function(){
  const target = 'inline-inner-html-target';
  function render(content) {
    if (content) innerHtmlSink(content, target);
  }
  const params = new URLSearchParams(location.search);
  if (params.has('payload')) render(params.get('payload'));
})();

Waiting for payload…

INLINE-2 (High): Direct field content → innerHTML

// inline-script[#2]
function inlineInnerHtmlFromField(fieldId, targetId) {
  const el = document.getElementById(fieldId);
  if (!el) return;
  innerHtmlSink(el.value, targetId);
}

INLINE-3 (Safe): Use textContent instead of innerHTML

// inline-script[#3]
(function(){
  const params = new URLSearchParams(location.search);
  const safe = params.get('safe');
  const target = document.getElementById('inline-safe-target');
  if (!target || !safe) return;
  target.textContent = safe;
})();

Try ?safe=<img src=x onerror=alert(1)> to see the difference.

Waiting for safe payload…

INLINE-4 (High): Direct field content → innerHTML

// inline-script[#2]

  const el = document.getElementById('inline_inner_html_payload');
  el.innerHTML = document.cookie

DOM-based test cases — `element.innerHTML`

Inline scenarios

External scenarios (click to run)

DOM-based test cases — element.innerHTML

Inline scenarios

External scenarios (click to run)

DOM-based test cases — `element.innerHTML`