1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
|
function determineInjectionSinkDescription(testCase) {
const targetWindowDescription = ("targetWindow" in testCase) ?
testCase.targetWindow.name : "";
const element = ("elementId" in testCase) ?
window.document.getElementById(testCase.elementId) : null;
const elementDescription = element ? (element.localName +
(element.target ? ("[target=" + element.target + "]") : "")) : null;
return ((elementDescription ? (elementDescription + ".") :
(targetWindowDescription ? (targetWindowDescription + ".") : ""))) +
testCase.propertySequence.join(".");
}
function assignJavascriptURLToInjectionSink(testCase) {
const element = ("elementId" in testCase) ?
document.getElementById(testCase.elementId) : null;
let currentObject = element ? element : testCase.targetWindow;
const propertySequence = testCase.propertySequence;
for (let i = 0; i < propertySequence.length - 1; ++i) {
currentObject = currentObject[propertySequence[i]];
}
currentObject[propertySequence.at(-1)] =
"javascript:parent.postMessage('executed', '*')";
if ("navigationFunction" in testCase) {
element[testCase.navigationFunction]();
}
}
function encodeURIWithApostrophes(uriWithApostrophes) {
const encodedURI = encodeURI(uriWithApostrophes);
// https://developer.mozilla.org/en-US/docs/Glossary/Percent-encoding
return encodedURI.replaceAll("'","%27");
}
|
