DOM XSS Taint Flow: Sources, Sinks & Sanitization

This simulator models untrusted browser input as it flows toward five real DOM-based cross-site-scripting sinks — innerHTML, document.write(), eval(), an inline event-handler attribute, and a javascript: href — through a chain of three independently toggleable defenses: context-aware output encoding, DOMPurify-style HTML sanitization, and a strict Content-Security-Policy. Each payload particle is evaluated against the exact combination of sink and active defenses at the moment it launches, so switching a toggle mid-flight never rewrites a payload already in the air. The result surfaces the core lesson of DOM XSS defense: encoding, sanitization and CSP each cover a different execution context, and the sink you're protecting determines which one actually matters.