The extension is not detecting sinks properly

kevin-mizu / domloggerpp

A browser extension that allows you to monitor, intercept, and debug JavaScript sinks based on customizable configurations.

https://x.com/kevin_mizu

GNU General Public License v3.0

461 stars 43 forks source link

The extension is not detecting sinks properly #30

Open ayadim opened 3 weeks ago

ayadim commented 3 weeks ago

Hi, First i would like to thank you for your efforts, the extension is working but not in some cases take an example this lab, https://portswigger-labs.net/dom-invader/testcases/augmented-dom-document-write/index.php?x=burpdomxss

even the parameter value was pass to document.write sink using backend but the extension didn't detect it?

Update: after many time restarting firefox it detect it but why is not logging requests at first not like dom-invader

Regards

kevin-mizu commented 1 week ago

Hi @ayadim 👋

Thanks for reporting this! However, this is a well-known issue with DOMLogger++ that I forgot to mention in the README.md :(

To explain further, this happens because document.write calls document.open, which clears all event listeners present on the document, breaking DOMLogger++.

I don’t have a solution for this at the moment, but I’ll update the README.md to include a warning about it and leave this issue open for now.

Cheers, Kévin