DOM-based test cases — Open Redirect sinks

// inline-script[#1]
(function(){
  function redirect(url) {
    if (!url) return;
    openRedirectSink(url, 'inline-open-log');
  }
  const params = new URLSearchParams(location.search);
  if (params.has('payload')) redirect(params.get('payload'));
  if (location.hash) {
    try { redirect(decodeURIComponent(location.hash.slice(1))); }
    catch (err) { redirect(location.hash.slice(1)); }
  }
  window.addEventListener('hashchange', () => {
    if (!location.hash) return;
    try { redirect(decodeURIComponent(location.hash.slice(1))); }
    catch (err) { redirect(location.hash.slice(1)); }
  });
})();

// inline-script[#2]
function inlineOpenRedirect(fieldId, logId) {
  const el = document.getElementById(fieldId);
  if (!el) return;
  openRedirectSink(el.value, logId);
}

// inline-script[#3]
(function(){
  const params = new URLSearchParams(location.search);
  const url = params.get('safe');
  if (!url) return;
  const res = openRedirectUtils.sameOriginGuard(url);
  document.getElementById('inline-safe-open').textContent = res.message;
})();

onclick="extOpenRedirectFromHash()"

onclick="extOpenRedirectFromSearch()"

onclick="extOpenRedirectFromWindowName()"

onclick="extOpenRedirectFromReferrer()"

onclick="extOpenRedirectFromCookie()"

onclick="extOpenRedirectFromLocalStorage()"

onclick="extOpenRedirectFromSessionStorage()"

onclick="extOpenRedirectFromSessionStorage()"