DOM-based test cases — Service Worker cache poisoning

Fetch handlers that trust event.request.url and write attacker-controlled requests into caches or redirects.

INLINE-1 (High): request URL controls cache + redirect

self.addEventListener('fetch', (event) => {
  const url = event.request.url;
  event.respondWith(
    caches.open('demo-cache').then((cache) => cache.put(url, new Response('ok')))
  );
  return Response.redirect(url);
});