DOMpohjaisia

DOMpohjaisia is a Finnish term that translates to "DOM-based" in English. It refers to a class of security vulnerabilities that occur when a web page uses the Document Object Model (DOM) to manipulate data provided by user input without proper sanitization. The DOM is a programming interface for HTML and XML documents, allowing scripts to dynamically access and update the content, structure, and style of a webpage.

DOM-based vulnerabilities typically arise when client-side JavaScript code takes data from a source that can be controlled by the user (such as the URL fragment identifier, often referred to as the hash, or other client-side storage mechanisms) and then passes it to a "sink" in the DOM. Sinks are functions or methods that can execute code or perform sensitive operations, like `eval()`, `innerHTML`, or `document.write()`. If the user-supplied data is not properly validated and escaped before being processed by the sink, an attacker can inject malicious scripts.

Common examples of DOM-based attacks include DOM-based Cross-Site Scripting (DOM-based XSS). In DOM-based XSS, the injected script runs in the context of the victim's browser session, allowing attackers to steal sensitive information like session cookies, perform actions on behalf of the user, or redirect the user to malicious websites. Unlike traditional stored or reflected XSS, the malicious payload in DOM-based XSS is not directly present in the server's response but is constructed and executed entirely on the client-side. Mitigating DOM-based vulnerabilities involves careful validation and sanitization of all user-supplied data before it is used in DOM manipulation operations.