DOM-based test cases — Web Message handling

High: 0 Medium: 0 Low: 0 Safe: 0 Total: 0

Scenarios below exercise window.postMessage and message event handlers. Unsafe cases demonstrate tainted event.data reaching DOM/code sinks, wildcard targetOrigin usage, and weak origin validation. Safe cards include strict origin allow-lists, payload validation and sanitisation.

High severity — tainted data reaches execution sinks

WM-H1 (High): message handler injects event.data into innerHTML without origin check

(function(){
  window.addEventListener('message', function handleUnsafeHTML(event) {
    var payload = event.data;
    document.getElementById('wm-preview').innerHTML = payload;
  });
})();

No message received yet.

WM-H2 (High): message handler executes payload with eval

(function(){
  window.addEventListener('message', function handleEval(event) {
    eval(event.data);
  });
})();

WM-H3 (High): message payload redirects the top-level location

(function(){
  window.addEventListener('message', function handleRedirect(event) {
    window.location = event.data;
  });
})();

WM-H4 (High): message payload written into document.cookie

(function(){
  window.addEventListener('message', function cookieSink(event) {
    document.cookie = "msg_data=" + event.data + "; Path=/";
  });
})();

WM-H5 (High): message payload written into selector

    // inline-script[#2]
window.addEventListener('message', function dsMessage(e) {
  var sel = e.data;
  try {
    var $target = $(sel);
    $target.text('updated by message');
  } catch (err) {
    console.warn('Selector error', err);
  }
});

Medium severity — weak validation or configuration issues

WM-M1 (Medium): wildcard targetOrigin when posting messages

function sendWildcardMessage(payload) {
  const frame = document.getElementById('message-target');
  frame.contentWindow.postMessage(payload, '*');
}

WM-M2 (Medium): postMessage invoked without specifying targetOrigin

function broadcastWithoutTarget(payload) {
  window.postMessage(payload);
}

Safe scenarios — strict origin & payload validation

WM-S1 (Safe): strict origin equality and textContent rendering

(function(){
  window.addEventListener('message', function safeEquality(event) {
    if (!isTrustedOrigin(event.origin)) return;
    var text = String(event.data);
    document.getElementById('wm-safe-preview').textContent = text;
  });
})();

Safe handler output.

WM-S2 (Safe): structured payload validation & sanitisation

(function(){
  window.addEventListener('message', function safeStructured(event) {
    if (!isTrustedOrigin(event.origin)) return;
    var result = validateMessagePayload(event.data);
    if (!result.ok) return;
    var clean = DOMPurify.sanitize(result.value.content);
    document.getElementById('wm-safe-structured').innerHTML = clean;
  });
})();

Sanitised content.