misc fixes to headless template (#5239)

headless/extract-urls.yaml

@@ -11,7 +11,9 @@ headless:
       - args:
           url: "{{BaseURL}}"
         action: navigate
+
       - action: waitload
+
       - action: script
         name: extract
         args:
@@ -19,6 +21,7 @@ headless:
             () => {
              return '\n' + [...new Set(Array.from(document.querySelectorAll('[src], [href], [url], [action]')).map(i => i.src || i.href || i.url || i.action))].join('\r\n') + '\n'
             }
+
     extractors:
       - type: kval
         part: extract

headless/postmessage-outgoing-tracker.yaml

@@ -15,6 +15,7 @@ headless:
           part: response
           key: Content-Security-Policy
           value: "default-src * 'unsafe-inline' 'unsafe-eval' data: blob:;"
+
       - action: script
         args:
           hook: true
@@ -45,19 +46,24 @@ headless:
                 }
               };
             }
+
       - args:
           url: "{{BaseURL}}"
         action: navigate
       - action: waitload
+
       - action: script
         name: alerts
         args:
-          code: window.alerts
+          code: |
+            () => { window.alerts }
+
     matchers:
       - type: word
         part: alerts
         words:
           - "at window.postMessage"
+
     extractors:
       - type: kval
         part: alerts

headless/postmessage-tracker.yaml

@@ -15,6 +15,7 @@ headless:
           part: response
           key: Content-Security-Policy
           value: "default-src * 'unsafe-inline' 'unsafe-eval' data: blob:;"
+
       - action: script
         args:
           hook: true
@@ -45,19 +46,24 @@ headless:
                 return oldListener.apply(this, arguments);
               };
             }
+
       - args:
           url: "{{BaseURL}}"
         action: navigate
       - action: waitload
+
       - action: script
         name: alerts
         args:
-          code: window.alerts
+          code: |
+            () => { window.alerts }
+
     matchers:
       - type: word
         part: alerts
         words:
           - "at Window.addEventListener"
+
     extractors:
       - type: kval
         part: alerts

headless/prototype-pollution-check.yaml

@@ -81,15 +81,19 @@ headless:
           url: "{{BaseURL}}"
         action: navigate
       - action: waitload
+
       - action: script
         name: alerts
         args:
-          code: window.alerts
+          code: |
+            () => { window.alerts }
+
     matchers:
       - type: word
         part: alerts
         words:
           - "__proto__"
+
     extractors:
       - type: kval
         part: alerts

headless/window-name-domxss.yaml

@@ -15,6 +15,7 @@ headless:
           part: response
           key: Content-Security-Policy
           value: "default-src * 'unsafe-inline' 'unsafe-eval' data: blob:;"
+
       - action: script
         args:
           hook: true
@@ -63,19 +64,24 @@ headless:
                 return oldEval.apply(this, arguments);
               };
             }
+
       - args:
           url: "{{BaseURL}}"
         action: navigate
       - action: waitload
+
       - action: script
         name: alerts
         args:
-          code: window.alerts
+          code: |
+            () => { window.alerts }
+
     matchers:
       - type: word
         part: alerts
         words:
           - "sink:"
+
     extractors:
       - type: kval
         part: alerts