From c1d1b7e36276951139ea0d33761fd19483828a51 Mon Sep 17 00:00:00 2001 From: maekuss Date: Wed, 3 Dec 2025 00:33:49 +0800 Subject: [PATCH] Add test.html for insecure postMessage example This HTML file demonstrates an insecure postMessage implementation that lacks origin validation, allowing for potential cross-site scripting (XSS) attacks. --- test.html | 67 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 67 insertions(+) create mode 100644 test.html diff --git a/test.html b/test.html new file mode 100644 index 0000000..25405eb --- /dev/null +++ b/test.html @@ -0,0 +1,67 @@ + + + + + + + Insecure postMessage without Origin Validation (VULNERABLE) + + + +

Insecure postMessage without Origin Validation (VULNERABLE)

+

This page intentionally demonstrates an insecure message event listener that does not validate event.origin and blindly injects received content into the DOM.

+ +
+

Status

+

Last message origin: (none)

+
No message yet.
+
+ + + +
+

How to reproduce the issue

+
    +
  1. Open this file in your browser (served via any origin).
    2. +
  2. In the browser console, open a different-origin tab (e.g., example.com): + 
    window.open('https://example.com', 'attacker');
    +
    3. +
  3. Switch to the console of the newly opened tab and run: + 
    window.opener.postMessage('<img src=x onerror=alert(\'Injected via \n\' + location.origin + \n\' — NO ORIGIN CHECK!\')>', '*');
    + You should see an alert on the vulnerable page and the DOM content updated. +
    4. +
+ + + +