Upon reading the Probe the Proto paper I noticed how they claim that Element.setAttribute is the most common XSS sink they encountered. We currently do support said sink however.
Consider the following document:
<!DOCTYPE html>
<html>
<head>
<title>SetAttribute Test</title>
<script>
function load() {
let handler =location.hash.substr(1);
handler = decodeURIComponent(handler);
let i = document.querySelector("#target");
i.setAttribute("onload", handler);
i.setAttribute("src", "https://raw.githubusercontent.com/SAP/project-foxhound/main/browser/branding/foxhound/default128.png");
}
</script>
</head>
<body onload="load()">
<img id="target" src="x" />
</body>
</html>When opened in Foxhound as follows: setAttribute.html#alert(1) I would expect a taintflow from location.hash to Element.setAttribute but nothing is reported.
Upon reading the Probe the Proto paper I noticed how they claim that Element.setAttribute is the most common XSS sink they encountered. We currently do support said sink however.
Consider the following document:
When opened in Foxhound as follows:
setAttribute.html#alert(1)I would expect a taintflow from location.hash to Element.setAttribute but nothing is reported.