DOM-based test cases — Link manipulation

These scenarios focus on attacker-controlled values influencing anchor attributes. No helpers beyond a single minimal script.

Inline scenarios

INLINE-1 (High): href set directly from location.hash (supports javascript:)

// inline-script[#1]
(function(){
  if (!location.hash) return;
  var raw = location.hash.slice(1);
  try { raw = decodeURIComponent(raw); } catch (err) {}
  linkCases.setLink('link-preview', raw, 'Set from hash');
})();

INLINE-2 (High): Query parameter appended without validation

// inline-script[#2]
(function(){
  var params = new URLSearchParams(location.search);
  var dest = params.get('link');
  if (!dest) return;
  var href = '/go?next=' + dest;
  linkCases.setLink('link-preview', href, 'Set from query');
})();

INLINE-3 (High): Form action without validation

// inline-script[#3]
(function(){
  var form = document.getElementById('form');
  if (!form) return;
  form.setAttribute('action', getCookieByName('form_action'));
})();

JQUERY-1 (High): jQuery attr() sets href from returnUrl param

jQuery link: #

// inline-script[#5]
$(function(){
  var params = new URLSearchParams(window.location.search);
  var returnUrl = params.get('returnUrl');
  if (!returnUrl) return;
  $('#jq-link-preview').attr('href', returnUrl);
});

Simple triggers

Buttons feed the same link preview

onclick="linkCases.setLink('link-preview', document.getElementById('user_link').value, 'Set from field')

linkCases.setLink('link-preview', linkCases.getLocal(), 'Set from localStorage')

onclick="linkCases.setLink('link-preview', linkCases.getCookie(), 'Set from cookie')"