DOM-Based XSS
DOM-based XSS occurs when an application contains client-side JavaScript that processes data from an untrusted source in an unsafe way, usually by writing the data to an execution sink.
The application reads the current location.href and dynamically writes breadcrumb navigation using innerHTML.
The search script parses the URL query parameter `q` with URLSearchParams and injects it into innerHTML.
The application parses window.location.hash for tab navigation and injects it into a tab title container.
User input is passed as a JSON or encoded string, unpacked by client JavaScript, and assigned to a DOM sink.
Data flows through a multi-function processing pipeline (extraction → normalization → templating → render).
A client-side regex filter attempts to sanitize input before passing it to innerHTML, but contains critical flaws.
A complex SPA with state store and dynamic plugin registry executes dynamic hooks from URL configuration.