@raishin/vanguard-frontier-agentic 3.0.1 → 3.1.0

package/tests/fixtures/frontend-security-detection/edge-cache-data-bleed-review/green/dashboard-revalidate-cookies.tsx

@@ -0,0 +1,32 @@
+import { cookies } from 'next/headers'
+import { Suspense } from 'react'
+
+// SAFE: no route-level `revalidate` export at all. The personalized lookup
+// is isolated behind a 'use cache: private' function instead, which caches
+// only in the requesting user's own browser and never shares a server-side
+// cache entry across users.
+export default async function DashboardPage() {
+  return (
+    <main>
+      <Suspense fallback={<p>Loading...</p>}>
+        <UserSummary />
+      </Suspense>
+    </main>
+  )
+}
+
+async function UserSummary() {
+  const user = await getUser()
+  return (
+    <>
+      <h1>Welcome, {user.name}</h1>
+      <p>Account balance: {user.balance}</p>
+    </>
+  )
+}
+
+async function getUser() {
+  'use cache: private'
+  const session = (await cookies()).get('session')?.value
+  return db.users.findBySession(session)
+}

package/tests/fixtures/frontend-security-detection/edge-cache-data-bleed-review/green/get-user-data.ts

@@ -0,0 +1,13 @@
+import { cookies } from 'next/headers'
+
+// SAFE: 'use cache: private' is the first statement in the function body.
+// Next.js caches this function's result only in the requesting user's own
+// browser -- it is never written to a shared server-side cache entry that a
+// different user's request could read.
+async function getUserData() {
+  'use cache: private'
+  const session = (await cookies()).get('session')?.value
+  return db.query(session)
+}
+
+export default getUserData

package/tests/fixtures/frontend-security-detection/edge-cache-data-bleed-review/green/product-static-params.tsx

@@ -0,0 +1,19 @@
+// SAFE: no `revalidate` export on this authenticated, per-user route. Instead
+// the route opts fully into dynamic rendering with `force-dynamic`, so every
+// request is rendered fresh on the server and nothing is ever written to a
+// shared ISR cache entry keyed only by the route path.
+export const dynamic = 'force-dynamic'
+
+export default async function AccountPage({
+  params,
+}: {
+  params: { userId: string }
+}) {
+  const account = await db.accounts.findByUserId(params.userId)
+  return (
+    <main>
+      <h1>{account.ownerName}'s account</h1>
+      <p>{account.privateNotes}</p>
+    </main>
+  )
+}

package/tests/fixtures/frontend-security-detection/edge-cache-data-bleed-review/red/api-user-profile-route.ts

@@ -0,0 +1,17 @@
+import { cookies } from 'next/headers'
+
+// DANGEROUS: the response carries `Cache-Control: public`, so an edge CDN in
+// front of this Route Handler is free to store the response body and replay
+// it to any subsequent client that requests the same URL -- including a
+// different, unauthenticated visitor -- even though the body is derived
+// entirely from the requesting user's own session cookie.
+export async function GET() {
+  const session = (await cookies()).get('session')?.value
+  const userData = await db.users.findBySession(session)
+  return new Response(JSON.stringify(userData), {
+    headers: {
+      'Cache-Control': 'public, max-age=300',
+      'Content-Type': 'application/json',
+    },
+  })
+}

package/tests/fixtures/frontend-security-detection/edge-cache-data-bleed-review/red/api-user-profile-vary.ts

@@ -0,0 +1,16 @@
+import { cookies } from 'next/headers'
+
+// DANGEROUS: the CDN is told this response varies only by Accept-Encoding.
+// Because the session Cookie is absent from Vary, the CDN treats requests
+// from two different users (two different Cookie values) as cache-equivalent
+// and may serve one user's cached, personalized response to the other.
+export async function GET() {
+  const session = (await cookies()).get('session')?.value
+  const userData = await db.users.findBySession(session)
+  return new Response(JSON.stringify(userData), {
+    headers: {
+      'Cache-Control': 'public, max-age=300',
+      Vary: 'Accept-Encoding',
+    },
+  })
+}

package/tests/fixtures/frontend-security-detection/edge-cache-data-bleed-review/red/dashboard-revalidate-cookies.tsx

@@ -0,0 +1,18 @@
+import { cookies } from 'next/headers'
+
+// DANGEROUS: revalidate is set on a route that also reads cookies() to render
+// per-user data. The ISR cache entry is shared across every visitor who hits
+// this path within the 60-second window -- the next visitor within that
+// window gets served the first visitor's cached, personalized HTML.
+export const revalidate = 60
+
+export default async function DashboardPage() {
+  const session = (await cookies()).get('session')?.value
+  const user = await db.users.findBySession(session)
+  return (
+    <main>
+      <h1>Welcome, {user.name}</h1>
+      <p>Account balance: {user.balance}</p>
+    </main>
+  )
+}

package/tests/fixtures/frontend-security-detection/edge-cache-data-bleed-review/red/get-user-data.ts

@@ -0,0 +1,13 @@
+import { cookies } from 'next/headers'
+
+// DANGEROUS: this server function reads cookies() to look up per-user data
+// but declares no cache boundary at all. If it is ever called from a context
+// that Next.js decides to cache (e.g. wrapped by a parent 'use cache' scope,
+// or a future refactor adds one), the session-derived result gets cached and
+// reused for a different user's request with no per-user cache key.
+async function getUserData() {
+  const session = (await cookies()).get('session')?.value
+  return db.query(session)
+}
+
+export default getUserData

package/tests/fixtures/frontend-security-detection/edge-cache-data-bleed-review/red/product-static-params.tsx

@@ -0,0 +1,25 @@
+// DANGEROUS: generateStaticParams enumerates per-user account IDs, and the
+// route also carries a `revalidate` export. Once the ISR window elapses, the
+// next request for /account/[userId] re-triggers rendering and re-caches the
+// authenticated page -- any visitor who polls this URL within the next
+// 60-second window is served the previously cached user's authenticated HTML.
+export const revalidate = 60
+
+export async function generateStaticParams() {
+  const users = await db.users.findAll()
+  return users.map((u) => ({ userId: u.id }))
+}
+
+export default async function AccountPage({
+  params,
+}: {
+  params: { userId: string }
+}) {
+  const account = await db.accounts.findByUserId(params.userId)
+  return (
+    <main>
+      <h1>{account.ownerName}'s account</h1>
+      <p>{account.privateNotes}</p>
+    </main>
+  )
+}

package/tests/fixtures/frontend-security-detection/frontend-auth-session-security-review/detectors.json

@@ -0,0 +1,50 @@
+{
+  "skill_id": "frontend-auth-session-security-review",
+  "detectors": [
+    {
+      "id": "token-in-local-storage",
+      "regex": "localStorage\\.setItem\\(\\s*['\"][^'\"]*[Tt]oken['\"]",
+      "skill_keywords": ["localStorage"],
+      "red": "red/token-storage.js",
+      "green": "green/token-storage.js",
+      "severity": "high",
+      "rationale": "localStorage.setItem for a token persists it where any script running in the page's origin -- stored/reflected XSS, a compromised third-party script, a malicious extension -- can read it via the same storage API; the green idiom keeps the access token in an in-memory variable only and re-acquires it after reload via an HttpOnly refresh-cookie flow, which the regex legitimately does not match since no localStorage call exists."
+    },
+    {
+      "id": "oauth-implicit-grant",
+      "regex": "response_type=token\\b",
+      "skill_keywords": ["response_type=token"],
+      "red": "red/oauth-flow.js",
+      "green": "green/oauth-flow.js",
+      "severity": "high",
+      "rationale": "response_type=token requests the OAuth implicit grant, returning the access token directly in the URL fragment where it is exposed to browser history and any script reading the URL, with no refresh token and no PKCE binding; the safe idiom uses response_type=code with code_challenge/code_challenge_method (authorization code + PKCE), a structurally different grant the regex does not match."
+    },
+    {
+      "id": "client-side-only-redirect-check",
+      "regex": "\\.includes\\([^)]*\\)\\s*\\)\\s*\\{\\s*window\\.location\\.assign",
+      "skill_keywords": ["window.location.assign"],
+      "red": "red/redirect-validation.js",
+      "green": "green/redirect-validation.js",
+      "severity": "high",
+      "rationale": "gating window.location.assign on a client-side `.includes(appDomain)` string check is not a control -- it is bypassable by hitting the server-side redirect endpoint directly with a malicious parameter, and the substring check itself is defeatable by URLs like `https://evil.example.com/?x=appDomain`; the safe idiom performs no client-side destination check at all and instead asks the server to resolve an opaque key, with the allow-list enforced server-side, so the dangerous client-side gate construct is absent."
+    },
+    {
+      "id": "pkce-missing-code-challenge",
+      "regex": "response_type=code(?:(?!code_challenge).)*?`",
+      "skill_keywords": ["PKCE"],
+      "red": "red/pkce-authorize-url.js",
+      "green": "green/pkce-authorize-url.js",
+      "severity": "high",
+      "rationale": "an authorization-code-flow request for a public client (SPA) that omits code_challenge/code_challenge_method has no PKCE binding, so an intercepted authorization code can be redeemed by an attacker at the token endpoint; the safe idiom includes code_challenge and code_challenge_method=S256 on the same authorization URL, which the negative-lookahead regex (scanning for response_type=code reaching the closing backtick without ever seeing code_challenge) correctly fails to match."
+    },
+    {
+      "id": "cookie-missing-httponly",
+      "regex": "Set-Cookie',\\s*`sessionid=(?:(?!HttpOnly)[^`])*`",
+      "skill_keywords": ["HttpOnly"],
+      "red": "red/session-cookie.js",
+      "green": "green/session-cookie.js",
+      "severity": "high",
+      "rationale": "a session Set-Cookie header with Secure and SameSite but no HttpOnly flag lets any script running in-origin (via stored/reflected XSS) read the session identifier via document.cookie, defeating the primary XSS-exfiltration mitigation for that cookie; the safe idiom adds HttpOnly alongside Secure and SameSite=Strict, which the negative-lookahead regex (scanning the cookie string for HttpOnly before the closing backtick) correctly fails to match."
+    }
+  ]
+}

package/tests/fixtures/frontend-security-detection/frontend-auth-session-security-review/green/oauth-flow.js

@@ -0,0 +1,14 @@
+// Safe idiom: authorization code flow with PKCE for a public client. The
+// authorization server returns a short-lived code, exchanged server-side for
+// tokens; nothing token-shaped ever appears in the URL/fragment/history.
+async function startLogin(clientId, redirectUri) {
+  const codeVerifier = generateCodeVerifier();
+  const codeChallenge = await sha256Base64Url(codeVerifier);
+  sessionStorage.setItem('pkce_code_verifier', codeVerifier);
+
+  const authUrl =
+    `https://auth.provider.com/authorize?response_type=code` +
+    `&client_id=${clientId}&redirect_uri=${redirectUri}` +
+    `&code_challenge=${codeChallenge}&code_challenge_method=S256`;
+  window.location.assign(authUrl);
+}

package/tests/fixtures/frontend-security-detection/frontend-auth-session-security-review/green/pkce-authorize-url.js

@@ -0,0 +1,6 @@
+// Safe idiom: authorization code flow with PKCE wired up -- code_challenge
+// and code_challenge_method are present on the authorization request, and
+// the paired code_verifier is sent at token exchange (not shown here).
+function buildAuthorizeUrl(clientId, redirectUri, codeChallenge) {
+  return `https://auth.provider.com/authorize?response_type=code&client_id=${clientId}&redirect_uri=${redirectUri}&code_challenge=${codeChallenge}&code_challenge_method=S256`;
+}

package/tests/fixtures/frontend-security-detection/frontend-auth-session-security-review/green/redirect-validation.js

@@ -0,0 +1,12 @@
+// Safe idiom: the client performs no destination validation at all. It
+// asks the server to resolve a short opaque key to a target, and the
+// server checks that target against its own allow-list before ever
+// returning it -- an attacker hitting the endpoint directly gets the same
+// server-side allow-list enforcement, so there is no bypassable client gate.
+async function completePostLoginRedirect(returnKey) {
+  const res = await fetch(`/api/resolve-return-url?key=${encodeURIComponent(returnKey)}`, {
+    credentials: 'include',
+  });
+  const { destination } = await res.json();
+  window.location.assign(destination);
+}

package/tests/fixtures/frontend-security-detection/frontend-auth-session-security-review/green/session-cookie.js

@@ -0,0 +1,6 @@
+// Safe idiom: session cookie carries all three independent flags --
+// HttpOnly blocks JS read access, Secure restricts transport to HTTPS, and
+// SameSite=Strict blocks cross-site attachment.
+function setSessionCookie(res, sessionId) {
+  res.setHeader('Set-Cookie', `sessionid=${sessionId}; HttpOnly; Secure; SameSite=Strict`);
+}

package/tests/fixtures/frontend-security-detection/frontend-auth-session-security-review/green/token-storage.js

@@ -0,0 +1,24 @@
+// Safe idiom: access token kept only in an in-memory module variable, never
+// persisted. Reload re-acquires a new access token via the HttpOnly
+// refresh-cookie flow (browser sends the cookie automatically; JS never
+// touches it), so nothing token-shaped is ever exposed to storage APIs.
+let accessToken = null;
+
+async function completeLogin(credentials) {
+  const res = await fetch('/api/login', {
+    method: 'POST',
+    body: JSON.stringify(credentials),
+  });
+  const { jwtToken } = await res.json();
+  accessToken = jwtToken;
+  return jwtToken;
+}
+
+async function reacquireAccessTokenAfterReload() {
+  // Server reads the HttpOnly refresh cookie automatically; response body
+  // carries only the fresh short-lived access token.
+  const res = await fetch('/api/token/refresh', { credentials: 'include' });
+  const { jwtToken } = await res.json();
+  accessToken = jwtToken;
+  return jwtToken;
+}

package/tests/fixtures/frontend-security-detection/frontend-auth-session-security-review/red/oauth-flow.js

@@ -0,0 +1,9 @@
+// Vulnerable: implicit-grant OAuth flow. The access token is returned
+// directly in the URL fragment, exposed to browser history, Referer
+// leakage, and any script that can read the URL. No PKCE, no refresh token.
+function startLogin(clientId, redirectUri) {
+  const authUrl =
+    `https://auth.provider.com/authorize?response_type=token` +
+    `&client_id=${clientId}&redirect_uri=${redirectUri}`;
+  window.location.assign(authUrl);
+}

package/tests/fixtures/frontend-security-detection/frontend-auth-session-security-review/red/pkce-authorize-url.js

@@ -0,0 +1,7 @@
+// Vulnerable: authorization code flow for a public client (SPA) with no
+// PKCE parameters. Without code_challenge/code_challenge_method, an
+// intercepted authorization code can be redeemed by an attacker at the
+// token endpoint -- PKCE is what binds the code to this specific client.
+function buildAuthorizeUrl(clientId, redirectUri) {
+  return `https://auth.provider.com/authorize?response_type=code&client_id=${clientId}&redirect_uri=${redirectUri}`;
+}

package/tests/fixtures/frontend-security-detection/frontend-auth-session-security-review/red/redirect-validation.js

@@ -0,0 +1,11 @@
+// Vulnerable: redirect destination is validated only in client-side
+// JavaScript before navigating. An attacker can bypass this entirely by
+// hitting the server-side login/callback endpoint directly with a
+// malicious `redirectUrl` query parameter -- this check never runs then.
+function completePostLoginRedirect(redirectUrl, appDomain) {
+  if (redirectUrl.includes(appDomain)) {
+    window.location.assign(redirectUrl);
+  } else {
+    window.location.assign('/');
+  }
+}

package/tests/fixtures/frontend-security-detection/frontend-auth-session-security-review/red/session-cookie.js

@@ -0,0 +1,6 @@
+// Vulnerable: session cookie is missing HttpOnly. Any script that runs in
+// the page's origin (stored/reflected XSS, a compromised third-party
+// script) can read document.cookie and exfiltrate the session identifier.
+function setSessionCookie(res, sessionId) {
+  res.setHeader('Set-Cookie', `sessionid=${sessionId}; Secure; SameSite=Strict`);
+}

package/tests/fixtures/frontend-security-detection/frontend-auth-session-security-review/red/token-storage.js

@@ -0,0 +1,11 @@
+// Vulnerable: access token persisted to localStorage, readable by any
+// injected script (stored/reflected XSS, compromised CDN dependency, etc.)
+async function completeLogin(credentials) {
+  const res = await fetch('/api/login', {
+    method: 'POST',
+    body: JSON.stringify(credentials),
+  });
+  const { jwtToken } = await res.json();
+  localStorage.setItem('accessToken', jwtToken);
+  return jwtToken;
+}

package/tests/fixtures/frontend-security-detection/frontend-dom-xss-csp-review/detectors.json

@@ -0,0 +1,77 @@
+{
+  "skill_id": "frontend-dom-xss-csp-review",
+  "detectors": [
+    {
+      "id": "innerhtml-assignment-sink",
+      "regex": "\\.innerHTML\\s*=(?!=)",
+      "skill_keywords": ["innerHTML"],
+      "red": "red/innerhtml-sink.js",
+      "green": "green/innerhtml-sink.js",
+      "severity": "high",
+      "rationale": "Assigning attacker-influenceable data (an API-sourced comment body) to .innerHTML parses it as markup and executes any embedded script/event-handler, a classic DOM XSS sink; the safe idiom assigns to .textContent, which the browser always treats as literal text and never parses as markup."
+    },
+    {
+      "id": "dangerously-set-inner-html",
+      "regex": "dangerouslySetInnerHTML",
+      "skill_keywords": ["dangerouslySetInnerHTML"],
+      "red": "red/dangerously-set-html.jsx",
+      "green": "green/dangerously-set-html.jsx",
+      "severity": "high",
+      "rationale": "dangerouslySetInnerHTML bypasses React's auto-escaping and injects the given __html string as raw markup, so an attacker-controlled profile bio can carry a script/onerror payload; the safe idiom uses ordinary JSX interpolation ({userBio}), which React always renders as an escaped text node."
+    },
+    {
+      "id": "eval-call-sink",
+      "regex": "\\beval\\(",
+      "skill_keywords": ["eval"],
+      "red": "red/eval-config.js",
+      "green": "green/eval-config.js",
+      "severity": "high",
+      "rationale": "Passing a user-typed search-box expression to eval() grants it full script execution in the page's origin; the safe idiom replaces eval with a grammar-limited parser function that only recognizes a fixed set of comparison operators and never reaches the JS engine's code evaluator."
+    },
+    {
+      "id": "document-write-sink",
+      "regex": "document\\.write(ln)?\\s*\\(",
+      "skill_keywords": ["document.write"],
+      "red": "red/legacy-write.js",
+      "green": "green/legacy-write.js",
+      "severity": "high",
+      "rationale": "document.write() concatenated with a query-string-derived campaign name streams attacker-controlled markup directly into the document parser, enabling script injection; the safe idiom builds a DOM element and assigns the untrusted value via .textContent, which is never parsed as HTML."
+    },
+    {
+      "id": "new-function-sink",
+      "regex": "new\\s+Function\\s*\\(",
+      "skill_keywords": ["Function()"],
+      "red": "red/dynamic-function.js",
+      "green": "green/dynamic-function.js",
+      "severity": "high",
+      "rationale": "Interpolating a user-saved template string into new Function(...) compiles attacker-controlled text into an executable function body, equivalent to eval; the safe idiom looks up a fixed key in a statically defined map of precompiled formatter functions, so no user-supplied text is ever compiled."
+    },
+    {
+      "id": "third-party-script-missing-sri",
+      "regex": "<script(?![^>]*integrity)[^>]*\\ssrc=\"https?://",
+      "skill_keywords": ["integrity", "crossorigin"],
+      "red": "red/third-party-script-no-sri.html",
+      "green": "green/third-party-script-no-sri.html",
+      "severity": "high",
+      "rationale": "A <script src> pointed at a third-party/CDN origin with no integrity attribute lets the browser execute whatever that origin currently serves, with no way to detect a compromised CDN account, hijacked DNS, or supply-chain-attacked dependency substituting malicious code for the expected file; the safe idiom pairs integrity=\"sha384-...\" with crossorigin=\"anonymous\", which makes the browser refuse to execute the script if the fetched bytes do not match the pinned hash."
+    },
+    {
+      "id": "dynamic-script-src-no-allowlist",
+      "regex": "script\\.src\\s*=\\s*(?!.*createScriptURL)",
+      "skill_keywords": ["createScriptURL"],
+      "red": "red/dynamic-script-untrusted-src.js",
+      "green": "green/dynamic-script-untrusted-src.js",
+      "severity": "high",
+      "rationale": "A tag-manager style loader that assigns a dynamically created <script> element's .src directly from a remote-config value with no origin check lets a compromised or malicious config endpoint redirect script execution to an attacker-controlled origin, and Subresource Integrity does not apply to a URL only known at runtime; the safe idiom routes the assignment through a Trusted Types createScriptURL policy that validates the URL's origin against a fixed allowlist before returning it."
+    },
+    {
+      "id": "csp-broad-script-src-wildcard",
+      "regex": "script-src[^;]*\\*",
+      "skill_keywords": ["script-src"],
+      "red": "red/csp-broad-script-src.txt",
+      "green": "green/csp-broad-script-src.txt",
+      "severity": "medium",
+      "rationale": "A CSP script-src scoped to a wildcard subdomain (e.g. https://*.cdn.example.com) permits execution of script from any host matching that pattern, so CSP provides no protection if any one of those hosts is compromised or supply-chain-attacked, and it does not substitute for Subresource Integrity on the scripts it allows; the safe idiom scopes script-src to a per-response nonce plus 'strict-dynamic', which does not rely on a broad host-based allowlist at all."
+    }
+  ]
+}

package/tests/fixtures/frontend-security-detection/frontend-dom-xss-csp-review/green/csp-broad-script-src.txt

@@ -0,0 +1,7 @@
+Content-Security-Policy:
+  default-src 'self';
+  script-src 'nonce-PER_RESPONSE_RANDOM_VALUE' 'strict-dynamic';
+  object-src 'none';
+  base-uri 'self';
+  frame-ancestors 'none';
+  require-trusted-types-for 'script';

package/tests/fixtures/frontend-security-detection/frontend-dom-xss-csp-review/green/dangerously-set-html.jsx

@@ -0,0 +1,6 @@
+// Renders a user profile bio fetched from the public API.
+function ProfileBio({ userBio }) {
+  // JSX text interpolation auto-escapes the string; React renders it as a
+  // text node, so markup in userBio can never execute.
+  return <div>{userBio}</div>;
+}

package/tests/fixtures/frontend-security-detection/frontend-dom-xss-csp-review/green/dynamic-function.js

@@ -0,0 +1,11 @@
+// Builds a custom formatter from a template string stored in user settings.
+function buildFormatter(userSuppliedTemplate) {
+  // A fixed, statically defined formatter is returned; the user-supplied
+  // template only selects which precomputed placeholder key to use, and is
+  // never compiled into executable code.
+  const allowedTemplates = {
+    currency: (value) => `$${value.toFixed(2)}`,
+    percent: (value) => `${(value * 100).toFixed(0)}%`,
+  };
+  return allowedTemplates[userSuppliedTemplate] || allowedTemplates.currency;
+}

package/tests/fixtures/frontend-security-detection/frontend-dom-xss-csp-review/green/dynamic-script-untrusted-src.js

@@ -0,0 +1,24 @@
+// Tag-manager style loader: fetch remote config, but constrain the
+// injected script's origin via a Trusted Types createScriptURL policy.
+const allowedScriptOrigins = ['https://cdn.example.com'];
+
+const scriptPolicy = trustedTypes.createPolicy('vendor-script-loader', {
+  createScriptURL(url) {
+    const parsed = new URL(url, location.href);
+    if (!allowedScriptOrigins.includes(parsed.origin)) {
+      throw new Error('Blocked script URL outside allowlist: ' + parsed.origin);
+    }
+    return url;
+  },
+});
+
+async function loadVendorScript() {
+  const config = await fetch('/api/marketing-config').then((r) => r.json());
+
+  const script = document.createElement('script');
+  script.src = scriptPolicy.createScriptURL(config.remoteScriptUrl);
+  script.crossOrigin = 'anonymous';
+  document.body.appendChild(script);
+}
+
+loadVendorScript();

package/tests/fixtures/frontend-security-detection/frontend-dom-xss-csp-review/green/eval-config.js

@@ -0,0 +1,8 @@
+// Evaluates a filter expression the user typed into the search box.
+import { parseFilterExpression } from './safe-filter-parser.js';
+
+function applyUserFilter(expressionFromSearchBox) {
+  // A dedicated grammar-limited parser interprets only a fixed set of
+  // comparison operators; it never hands the string to the JS engine.
+  return parseFilterExpression(expressionFromSearchBox);
+}

package/tests/fixtures/frontend-security-detection/frontend-dom-xss-csp-review/green/innerhtml-sink.js

@@ -0,0 +1,7 @@
+// Renders a user-supplied comment body directly into the DOM.
+function renderComment(comment) {
+  const el = document.getElementById('comment-body');
+  // text-only assignment: the browser auto-escapes the string, no markup
+  // is ever parsed, so untrusted comment.body cannot inject elements.
+  el.textContent = comment.body;
+}

package/tests/fixtures/frontend-security-detection/frontend-dom-xss-csp-review/green/legacy-write.js

@@ -0,0 +1,9 @@
+// Injects an ad-network snippet whose URL parameter names the campaign.
+function renderCampaignBanner(campaignNameFromQueryString) {
+  // The value is sanitized and inserted as a text node via a template,
+  // never through the legacy document-stream write API.
+  const banner = document.createElement('div');
+  banner.className = 'banner';
+  banner.textContent = campaignNameFromQueryString;
+  document.body.appendChild(banner);
+}

package/tests/fixtures/frontend-security-detection/frontend-dom-xss-csp-review/green/third-party-script-no-sri.html

@@ -0,0 +1,14 @@
+<!-- Vendor analytics snippet loaded from a third-party CDN, with SRI enforced -->
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <title>Third-party script with SRI</title>
+</head>
+<body>
+  <script
+    src="https://cdn.example.com/analytics.js"
+    integrity="sha384-BASE64_HASH_PLACEHOLDER"
+    crossorigin="anonymous"></script>
+</body>
+</html>

package/tests/fixtures/frontend-security-detection/frontend-dom-xss-csp-review/red/csp-broad-script-src.txt

@@ -0,0 +1,6 @@
+Content-Security-Policy:
+  default-src 'self';
+  script-src https://*.cdn.example.com;
+  object-src 'none';
+  base-uri 'self';
+  frame-ancestors 'none';

package/tests/fixtures/frontend-security-detection/frontend-dom-xss-csp-review/red/dangerously-set-html.jsx

@@ -0,0 +1,6 @@
+// Renders a user profile bio fetched from the public API.
+function ProfileBio({ userBio }) {
+  // userBio is attacker-controlled (any user can set their own bio) and is
+  // injected as raw HTML with no sanitizer pass.
+  return <div dangerouslySetInnerHTML={{ __html: userBio }} />;
+}

package/tests/fixtures/frontend-security-detection/frontend-dom-xss-csp-review/red/dynamic-function.js

@@ -0,0 +1,7 @@
+// Builds a custom formatter from a template string stored in user settings.
+function buildFormatter(userSuppliedTemplate) {
+  // userSuppliedTemplate is loaded from the user's saved preferences (editable
+  // via the settings API) and compiled straight into an executable function body.
+  const formatter = new Function('value', 'return `' + userSuppliedTemplate + '`;');
+  return formatter;
+}

package/tests/fixtures/frontend-security-detection/frontend-dom-xss-csp-review/red/dynamic-script-untrusted-src.js

@@ -0,0 +1,11 @@
+// Tag-manager style loader: fetch remote config, then inject a script
+// whose src comes straight from that config with no allowlist check.
+async function loadVendorScript() {
+  const config = await fetch('/api/marketing-config').then((r) => r.json());
+
+  const script = document.createElement('script');
+  script.src = config.remoteScriptUrl;
+  document.body.appendChild(script);
+}
+
+loadVendorScript();

package/tests/fixtures/frontend-security-detection/frontend-dom-xss-csp-review/red/eval-config.js

@@ -0,0 +1,6 @@
+// Evaluates a filter expression the user typed into the search box.
+function applyUserFilter(expressionFromSearchBox) {
+  // expressionFromSearchBox is the raw query-string value the user typed;
+  // running it through eval gives it full script execution in this origin.
+  return eval(expressionFromSearchBox);
+}

package/tests/fixtures/frontend-security-detection/frontend-dom-xss-csp-review/red/innerhtml-sink.js

@@ -0,0 +1,7 @@
+// Renders a user-supplied comment body directly into the DOM.
+function renderComment(comment) {
+  const el = document.getElementById('comment-body');
+  // comment.body comes straight from the API response (attacker-controlled
+  // via the comment submission form) with no sanitization step.
+  el.innerHTML = comment.body;
+}

package/tests/fixtures/frontend-security-detection/frontend-dom-xss-csp-review/red/legacy-write.js

@@ -0,0 +1,6 @@
+// Injects an ad-network snippet whose URL parameter names the campaign.
+function renderCampaignBanner(campaignNameFromQueryString) {
+  // campaignNameFromQueryString is read straight from location.search and
+  // concatenated into markup written directly into the document stream.
+  document.write('<div class="banner">' + campaignNameFromQueryString + '</div>');
+}

package/tests/fixtures/frontend-security-detection/frontend-dom-xss-csp-review/red/third-party-script-no-sri.html

@@ -0,0 +1,11 @@
+<!-- Vendor analytics snippet loaded from a third-party CDN -->
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <title>Third-party script without SRI</title>
+</head>
+<body>
+  <script src="https://cdn.example.com/analytics.js"></script>
+</body>
+</html>