Please enable JavaScript.

Coggle requires JavaScript to display documents.

DOM-based (sink (example (JS-based (eval() - it processes the argument…

- - - - document.body.innerHTML - potentially allows an attacker to inject malicious HTML and execute arbitrary JavaScript.
    - - eval() - it processes the argument that is passed to it as JavaScript
      - Function() constructor
      - setTimeout()
      - setInterval()
      - setImmediate()
      - execCommand()
      - execScript()
      - msSetImmediate()
      - range.createContextualFragment()
      - crypto.generateCRMFRequest()
- - - - scripts
      - referrer
      - links
      - images
      - head
      - forms
      - anchors
      - cookie
      - URL
      - frames
    - - contains the URLs visited by the user (within a browser window)
      - history object is part of the window object and is accessed through the window.history property
      - back(), forward(), go(), length
      - history.pushState history.replaceState
    - - name
      - window object represents an open window in a browser
      - frames