Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

"Link manipulation (DOM-based)" false positive - local variable override

Andrii | Last updated: Apr 17, 2016 08:54AM UTC

Hi, Burp Scanner v1.6.38 generated false positive for "Link manipulation (DOM-based)". Excerpt from report: Data is read from location and passed to the 'href' property of a DOM element via the following statements: location = setParameter(location, tokenName, tokenValue); parser.href = url; However, Burp Scanner didn't took into account, that "location" variable is not "window.location", but a local variable inside this function: function injectTokenAttribute(element, attr, tokenName, tokenValue, pageTokens) { var location = element.getAttribute(attr); if(location != null && isValidUrl(location)) { var uri = parseUri(location); var value = (pageTokens[uri] != null ? pageTokens[uri] : tokenValue); if (getParameter(location, tokenName) != tokenValue) { location = setParameter(location, tokenName, tokenValue); try { element.setAttribute(attr, location); } catch (e) { // attempted to set/update unsupported attribute } } } } As you can see there is assignment operation: var location = element.getAttribute(attr); Thanks, Andrii.

PortSwigger Agent | Last updated: Apr 18, 2016 07:58AM UTC