DOMpohjaista

DOMpohjaista is a Finnish term that translates to "DOM-based" in English. It refers to a type of cross-site scripting (XSS) vulnerability that occurs when an attacker manipulates the Document Object Model (DOM) of a web page to execute malicious scripts. Unlike other XSS attacks that might inject scripts into the server-side code or the HTML response, DOMpohjaista attacks exploit vulnerabilities in how client-side JavaScript code handles user-supplied data and modifies the DOM.

The core of a DOMpohjaista vulnerability lies in client-side scripts that read data from a source that can be controlled by an attacker (such as a URL fragment, `location.hash`, or `document.referrer`) and then use this data to modify the DOM in an unsafe way. For example, if a script takes a value from `location.hash` and directly writes it into the HTML content of the page without proper sanitization, an attacker could craft a URL with a malicious script in the fragment, leading to the script's execution within the user's browser.

Detecting and preventing DOMpohjaista vulnerabilities requires careful examination of client-side JavaScript code. Developers must ensure that any data sourced from user-controllable locations is thoroughly validated and sanitized before being used to dynamically alter the DOM. Techniques such as encoding special characters or using secure DOM manipulation methods can help mitigate these risks. The OWASP (Open Web Application Security Project) Top 10 often includes XSS, and DOM-based XSS is a significant subtype that web application security professionals must address.