Taint Tracking Test Websites - Micro Benchmarks - proxy-getter-2

Description: Test the taint engine's ability on different builtins.

Source:

Type: ManuallyAdded

Code:

J$$.wrapTaint()

Sink:

Type: XSS

Code:

document.createElement('script').src

Testing Code:

* @Name: proxy-getter-2
 * @SourceType: ManuallyAdded
 * @SourceCode: J$$.wrapTaint()
 * @SinkType: XSS
 * @SinkCode: document.createElement('script').src
 */
(function() {
  if (typeof J$$ !== 'undefined' && J$$.wrapTaint) {
    let taintedValue = { a: J$$.wrapTaint('tainted') };
    const handler = {
      get(target, prop, receiver) {
        if (prop === 'b') {
          return Reflect.get(target, 'a');
        }
        return Reflect.get(...arguments);
      },
    };
    
    let proxy = new Proxy(taintedValue, handler);
    let taintedResult = proxy.a;

    let scriptEle = document.createElement('script');
    scriptEle.src = `https://example.com/${taintedResult}`;
  } else {
    console.error("J$$ is not defined or does not have wrapTaint method.");
  }
})();

Next Test