Dynamic (#77)

tests/dynamic_fixtures/javascript/browser_event/benign.js

@@ -0,0 +1,19 @@
+// Phase 13 — browser-side event handler, benign control.
+//
+// Uses `textContent` so the payload's `<script>` tag is HTML-escaped before
+// serialisation; the XSS oracle marker cannot appear in stdout because
+// `<` becomes `&lt;`.
+
+'use strict';
+// nyx-shape: browser-event
+
+function clickHandler(payload) {
+    process.stdout.write('__NYX_SINK_HIT__\n');
+    const el = document.getElementById('out');
+    if (el) {
+        el.textContent = String(payload);
+    }
+    return el ? el.textContent : '';
+}
+
+module.exports = { clickHandler };