Document Object Model (DOM)

The Document Object Model (DOM) is a web browser's hierarchical representation of the elements on the page. Websites can use JavaScript to manipulate the nodes and objects of the DOM, as well as their properties. DOM manipulation in itself is not a problem. In fact, it is an integral part of how modern websites work. However, JavaScript that handles data insecurely can enable various attacks. DOM-based vulnerabilities arise when a website contains JavaScript that takes an attacker-controllable value, known as a source, and passes it into a dangerous function, known as a sink.

DOM-based vulnerability	Example sink
DOM XSS LABS	document.write()
Open redirection LABS	window.location
Cookie manipulation LABS	document.cookie
JavaScript injection	eval()
Document-domain manipulation	document.domain
WebSocket-URL poisoning	WebSocket()
Link manipulation	element.src
Web message manipulation	postMessage()
Ajax request-header manipulation	setRequestHeader()
Local file-path manipulation	FileReader.readAsText()
Client-side SQL injection	ExecuteSql()
HTML5-storage manipulation	sessionStorage.setItem()
Client-side XPath injection	document.evaluate()
Client-side JSON injection	JSON.parse()
DOM-data manipulation	element.setAttribute()
Denial of service	RegExp()

Resources

DOM-based vulnerabilities | Web Security AcademyWebSecAcademy