dom-xss

What problem does it solve?

This Skill addresses DOM-based Cross-Site Scripting (XSS), a vulnerability where client-side JavaScript mishandles attacker-controlled data, leading to arbitrary code execution without server interaction.

Core Features & Use Cases

• Vulnerability Detection: Identifies JavaScript code that reads from controllable DOM sources (e.g., location.hash, document.referrer) and writes to dangerous sinks (e.g., innerHTML, eval).
• Exploitation Scenarios: Provides examples of how DOM XSS can be exploited through various sinks and data sources.
• Fix Patterns: Offers concrete solutions like using textContent instead of innerHTML, sanitizing input with DOMPurify, and implementing Content Security Policy (CSP).
• Use Case: A security analyst uses this skill to audit a web application's JavaScript code, pinpointing specific instances where user input from URL parameters is directly rendered into the page's HTML, thus preventing a potential XSS attack.

Quick Start

Audit the provided JavaScript code for DOM-based XSS vulnerabilities by checking for tainted data flow from DOM sources to dangerous sinks.