DOM-based XSS WAHS Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A developer is fixing a DOM-based XSS vulnerability where untrusted data from location.search is used in an element's innerHTML. The developer proposes the following fix: var encoded = encodeURIComponent(userInput); element.innerHTML = encoded;. Is this fix effective?

   • ANo, because encodeURIComponent will break the application's functionality.
   • BYes, because encodeURIComponent will encode all dangerous characters like < and >.
   • CYes, because innerHTML will automatically encode the value.
   • DNo, because encodeURIComponent encodes for URL context, not HTML context, and the encoded string will be displayed as literal text but may still be dangerous in some contexts.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A development team is hardening a large legacy application against DOM-based XSS. The application has many instances of unsafe sinks like innerHTML and document.write. The team has a limited budget and must choose a single mitigation that provides the broadest protection across all sinks. Which approach is the most effective given the constraint?

   • ARefactor all instances of innerHTML and document.write to use textContent and createTextNode.
   • BAdd a server-side WAF rule that blocks requests containing common XSS payloads.
   • CUse a JavaScript library that automatically encodes all DOM writes.
   • DImplement a strict Content Security Policy (CSP) that disallows inline scripts and restricts script sources.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security engineer is analyzing a complex single-page application. The application has a client-side router that reads the URL path and renders different views. The engineer suspects a DOM-based XSS vulnerability where the path is used in a template that is inserted into the DOM. The engineer has confirmed that the path is not sent to the server. Which statement best describes the challenge of detecting this vulnerability and the most effective detection method?

   • AThe vulnerability is not a security risk because the URL path is not a common source for DOM-based XSS.
   • BThe vulnerability can be easily detected by a web application firewall (WAF) that blocks malicious URL paths.
   • CThe vulnerability is difficult to detect with automated scanners because the payload is in the URL path and the execution is client-side; the most effective method is manual code review of the client-side router and template rendering logic.
   • DThe vulnerability can be detected by sending a payload in the URL path and checking the server response for the payload.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company's customer portal has a DOM-based XSS vulnerability that can be triggered by a crafted link. An attacker sends a phishing email with a malicious link to a logged-in customer. The payload steals the session cookie and sends it to an attacker-controlled server. Which statement best describes the full impact of this attack?

   • AThe attacker can read the customer's data but cannot perform any actions because the session cookie is HttpOnly.
   • BThe attacker can only deface the customer portal's homepage, affecting all users.
   • CThe attacker can only cause a denial of service by crashing the customer's browser.
   • DThe attacker can hijack the victim's session, access their personal data, and perform actions on their behalf, such as changing account details or making unauthorized transactions.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Consider the following JavaScript code: ``` var name = location.hash.substring(1); document.getElementById('greeting').innerHTML = 'Hello, ' + name; ``` What is the data flow from source to sink?

   • ASource: innerHTML; Sink: location.hash; The data is safely encoded.
   • BSource: document; Sink: greeting; The code uses safe DOM APIs.
   • CSource: document.getElementById; Sink: location.hash; Sanitization is applied via substring.
   • DSource: location.hash; Sink: innerHTML; No sanitization is applied.
   Reveal Solution Discussion Select an answer first