Description: Explore how DOM properties can be manipulated for benchmark testing in browser environments.
Source:
Type: DOC-TYPE-2
Code:
document.embeds[0].src
Sink:
Type: XSS
Code:
document.createElement('object').data
Testing Code:
* @Name: embeds.js
* @SourceType: DOC-TYPE-2
* @SourceCode: document.embeds[0].src
* @SinkType: XSS
* @SinkCode: document.createElement('object').data
*/
// Create the necessary HTML element
let embed = document.createElement('embed');
embed.src = 'https://example.com/embed.swf';
embed.style.display = 'none';
document.body.appendChild(embed);
// JavaScript to create and append the script element
let scriptEle = document.createElement('object');
let data = document.embeds[0].src;
scriptEle.src = data;
document.body.appendChild(scriptEle);