id: dom-xss

info:
  name: DOM XSS Sources & Sinks
  reference: Inspired by https://portswigger.net/blog/introducing-dom-invader
  # The existence of a sink or source does not by itself indicate a vulnerability. Due diligence must be performed on the results before opening a bug report.
  author: geeknik
  severity: info
  tags: xss,file

file:
  - extensions:
      - js
      - ts
      - html
      - php
      - cs
      - rb
      - py

    extractors:
      - type: regex
        name: sink
        part: body
        regex:
          - 'jQuery(\.globalEval|\.\$|\.constructor|\.parseHTML|\.has|\.init|\.index|\.add|\.append|\.appendTo|\.after|\.insertAfter|\.before|\.insertBefore|\.html|\.prepend|\.prependTo|\.replaceWith|\.replaceAll|\.wrap|\.wrapALL|\.wrapInner|\.prop\.innerHTML|\.prop\.outerHTML|\.attr\.onclick|\.attr\.onmouseover|\.attr.onmousedown|\.attr\.onmouseup|\.attr\.onkeydown|\.attr\.onkeypress|\.attr\.onkeyup|\.attr\.href|\.attr\.src|\.attr\.data|\.attr\.action|\.attr\.formaction|\.prop\.href|\.prop\.src|\.prop\.data|\.prop\.action|\.prop\.formaction)'
          - 'eval|Function|execScript|msSetImmediate|fetch(\.body)?|form\.action|websocket|RegExp|javascriptURL|createContextualFragment|webdatabase\.executeSql|JSON\.parse'
          - 'fetch(\.body)?'
          - 'history(\.pushState|\.replaceState)'
          - '(session|local)Storage(\.setItem(\.name|\.value))'
          - 'anchor(\.href|\.target)'
          - 'button(\.formaction|\.value)'
          - 'set(Timeout|Interval|Immediate)'
          - 'script(\.src|\.textContent|\.innerText|\.innerHTML|\.appendChild|\.append)'
          - 'document(\.write|\.writeln|\.implementation\.createHTMLDocument|\.domain|\.cookie|\.evaluate)'
          - 'element(\.outerText|\.innerText|\.textContent|\.style\.cssText|\.innerHTML|\.outerHTML|\.insertAdjacentHTML|\.setAttribute(\.onclick|\.onmouseover|\.onmousedown|\.onmouseup|\.onkeydown|\.onkeypress|\.onkeyup|\.href|\.src|\.data|\.action|\.formaction))'
          - 'location(\.href|\.replace|\.assign|\.pathname|\.protocol|\.host|\.hostname|\.hash|\.search)?'
          - 'iframe(\.srcdoc|\.src)'
          - 'xhr(\.open|\.send|\.setRequestHeader(\.name|\.value)?)'
      - type: regex
        name: source
        part: body
        regex:
          - 'location(\.href|\.hash|\.search|\.pathname)?'
          - 'window\.name'
          - 'document(\.URL|\.referrer|\.documentURI|\.baseURI|\.cookie)'