I observe that taint flows with XMLHttp.response as source are not detected for each sink.
For example, if sink is document.write taint flow is not recognized.
On the following page, the taint flow XMLHttp.response => document.write is not recognized (XSS vulnerability was verified manually and taint flow is detected with innerHtml and eval as sinks)
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
</head>
<body>
<h1>Reflected XSS via XMLHttpRequest.response</h1>
<script>
var payload = decodeURIComponent(location.hash.substring(1))
// create a new XMLHttpRequest object
var xhr = new XMLHttpRequest();
// localhost URL to send the request to
var url = payload;
// open a GET request to the URL
xhr.open('GET', url, true);
// set the response type to text
xhr.responseType = 'text';
// define what happens on successful data submission
xhr.onload = function () {
if (xhr.status >= 200 && xhr.status < 300) {
console.log('Request successful:', xhr.responseText);
// taint flow not detected
document.write(xhr.responseText);
// taint flow detected
// document.body.innerHTML = xhr.responseText;
// taint flow detected
// eval(xhr.responseText);
} else {
console.error('Request failed with status:', xhr.status);
}
};
// send the request
xhr.send();
</script>
</body>
</html>
I observe that taint flows with XMLHttp.response as source are not detected for each sink.
For example, if sink is document.write taint flow is not recognized.
On the following page, the taint flow XMLHttp.response => document.write is not recognized (XSS vulnerability was verified manually and taint flow is detected with innerHtml and eval as sinks)