DOM innerHTML sinkEMBEDDED

Check whether untrusted values from location, hash, postMessage, and similar sources reach unsafe sinks such as innerHTML.

DOM sink check

This scenario tests how user input is rendered into HTML / DOM, not iframe sandbox behavior.

Verify whether untrusted sources reach innerHTML, outerHTML, or insertAdjacentHTML
Check whether rendering can be replaced with textContent or DOM APIs
Validate client router, hash, and postMessage payloads before writing to a sink

Payload

Payload to copy

Checks whether event handlers execute when inserted through innerHTML.

Paste into

An editor, comment, profile, or HTML-rendering input in a dev/staging surface you are authorized to test

Result rule

Execution is a warning sign. Expected defenses render the code as text or remove the executable parts.

The preview intentionally performs unsafe rendering for learning. In a real service, this payload should be escaped as text or removed.

// no logs

DOM-based XSS can happen even when the server response is safe. The client code itself passes an untrusted source into an unsafe sink.
Typical sources are location.search, location.hash, postMessage, and storage values. Typical sinks are innerHTML, outerHTML, and insertAdjacentHTML.
Render via textContent or DOM APIs whenever possible, and route real HTML only through a trusted HTML filter.