search

ariary / DomXssFinder

Find sources and sinks in js code that could lead to DOM XSS 🔎💧🚰
21 stars 3 forks source link

Add some more and correct one #1

Open Sh4d0wHunt3rX opened 7 months ago

Sh4d0wHunt3rX commented 7 months ago

Hi, thanks for this script : )

I was comparing yours with this one which is only the list of sources and sinks: https://github.com/Sivnerof/Sources-And-Sinks-Cheatsheet

I noticed you wrote: WINDOWS_SOURCES="windows.name"

I'm not sure, but I guess it should be window.name

Also, I couldn't find these:

document.write() document.writeln() element.outerHTML element.insertAdjacentHTML element.onevent

The following jQuery functions are also sinks that can lead to DOM-XSS vulnerabilities:

add() after() append() animate() insertAfter() insertBefore() before() html() prepend() replaceAll() replaceWith() wrap() wrapInner() wrapAll() has() constructor() init() index() jQuery.parseHTML() $.parseHTML()

Thanks : )

ariary commented 7 months ago

Thank you ! I've updated the list and fix the typo

I will look for the jquery one later (don't hesitate to make a PR otherwise)

Sh4d0wHunt3rX commented 7 months ago

Thank you so much ❤️