What is client side non-DOM XSS?

Question

I've been reading on the new categories of XSS. According to OWASP, they're no longer just reflected, stored and DOM-based XSS, but rather server/client side, and then subdivided into reflected/stored.

According to the site, DOM-based XSS is just a specific section of client-side XSS. I'm not following the distinction between DOM and non-DOM client side XSS. Every client side XSS I can think of involves the DOM. I understand how I can have persistent and non-persistent DOM client side XSS, but what would be an example of non-DOM client side XSS (reflected and stored)?

Answer 1

I'll try to explain using a few quotes from the OWASP page you linked. First, what is DOM based XSS?

...the source of the data is in the DOM, the sink is also in the DOM, and the data flow never leaves the browser.

Client side XSS does not always fulfill this definition. Even though the data is inserted into the page at the client, the data can come from somewhere else, lika an API response from the server:

[For client-side XSS, the] source of this data could be from the DOM, or it could have been sent by the server (via an AJAX call, or a page load).

So (my highlight):

With these new definitions, the definition of DOM Based XSS doesn’t change. DOM Based XSS is simply a subset of Client XSS, where the source of the data is somewhere in the DOM, rather than from the server.

An example of non-DOM client-side XSS would be if the client makes an API call, retrieving some untrusted data, and pass it straight to innerHTML without any sanitation.

Answer 2

"DOM-based" is part of the old three-part naming convention (reflected, stored, DOM). It's not a current term anymore as XSS stopped being just a server problem. All client-side XSS attacks use the DOM, regardless of persistence or injection point.

The DOM term implies a dynamic action; something that happens/changes after the page loads, whereas server-side issue show up in the HTML markup of the page's view-source.