URLフラグメント経由のDOM型XSS

DOM-based XSS is XSS where the server is innocent. The bug lives entirely in your client-side JavaScript, and your server logs will never show a trace of the attack — the URL fragment after `#` never reaches the server. That makes it the form of XSS most likely to slip through both WAF and SOC. SPA frameworks have made it more common in production, not less: every router that reads location for state, every analytics tag that grabs query parameters, every 'remember the user's input' pattern that stores partial state in the URL is a candidate. The classic Reflected XSS that lived in server-rendered HTML has migrated client-side.

DOM XSS appears when client-side JavaScript moves URL or state data into the page without safe encoding. The server may be clean while the shipped frontend creates the execution path.

Same as classical XSS — full JavaScript execution context inside your origin, with access to cookies (unless HttpOnly), localStorage, the DOM, and any auth tokens visible to JS. Account takeover via session theft, action hijack on behalf of the user, or a phishing overlay convincing enough that the user re-enters credentials inside the legitimate origin.

Don't pass URL data to dangerous sinks. Use `textContent` for inserting text into the DOM. For frameworks, lean on the safe-by-default rendering — React's children, Vue's `{{ }}`, Angular's interpolation — and audit every `dangerouslySetInnerHTML`, `v-html`, and `[innerHTML]` for whether the input is trusted. When you genuinely need to render user-supplied HTML, sanitize through DOMPurify with a strict allowlist; never write your own sanitizer. Avoid `eval`, `setTimeout(string)`, `Function(string)`, `setInterval(string)` — anywhere a string-as-code is accepted. Apply a strict Content Security Policy without `unsafe-eval` and with `script-src 'self' 'strict-dynamic' 'nonce-…'` so even successful injection can't execute. As a sanity check, grep your codebase for `innerHTML\s*=` and `location\.hash` — every match is a code path to review.