From 98fe37d0f5d7b5ca289f57e2b1f4a29162d17ef3 Mon Sep 17 00:00:00 2001 From: maekuss Date: Wed, 3 Dec 2025 01:42:09 +0800 Subject: [PATCH] Add test2.html to demonstrate insecure postMessage This HTML file demonstrates an insecure postMessage implementation that lacks origin validation, allowing potential cross-site scripting (XSS) attacks. --- test2.html | 67 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 67 insertions(+) create mode 100644 test2.html diff --git a/test2.html b/test2.html new file mode 100644 index 0000000..25405eb --- /dev/null +++ b/test2.html @@ -0,0 +1,67 @@ + + + + + + + Insecure postMessage without Origin Validation (VULNERABLE) + + + +

Insecure postMessage without Origin Validation (VULNERABLE)

+

This page intentionally demonstrates an insecure message event listener that does not validate event.origin and blindly injects received content into the DOM.

+ +
+

Status

+

Last message origin: (none)

+
No message yet.
+
+ + + +
+

How to reproduce the issue

+
    +
  1. Open this file in your browser (served via any origin).
    2. +
  2. In the browser console, open a different-origin tab (e.g., example.com): + 
    window.open('https://example.com', 'attacker');
    +
    3. +
  3. Switch to the console of the newly opened tab and run: + 
    window.opener.postMessage('<img src=x onerror=alert(\'Injected via \n\' + location.origin + \n\' — NO ORIGIN CHECK!\')>', '*');
    + You should see an alert on the vulnerable page and the DOM content updated. +
    4. +
+ + + +