Is echoing GET parameters into a script tag reflected or DOM based XSS?

Question

I am struggling to understand whether the following would be considered as a DOM-based XSS or reflected XSS and was hoping that someone could help me distinguish the the difference.

Imagine the following scenario:

1. Imagine that a site has a search functionality in which the user supplies input in a GET request e.g. www.testsiteexample.com?search=test;%20alert(1);

2. The input from the search input is reflected back within a JavaScript variable:

   var searchResult = *userdata*
   

I think I've answered my own question as the user input is reflected unsanitized within the javascript variable declaration - my guess would be this is considered reflective XSS. But at the same time DOM based XSS as stated by OWASP is:

The attack payload is executed as a result of modifying the DOM “environment” in the victim’s browser used by the original client side script, so that the client side code runs in an “unexpected” manner. That is, the page itself (the HTTP response that is) does not change, but the client side code contained in the page executes differently due to the malicious modifications that have occurred in the DOM environment.

So does the fact that the user input changes the client side script received back to the user, make this a reflective XSS?

Answer 1

This is reflected XSS, not DOM-based XSS.

The difference is subtle, but here are the key sentences.

OWASP - DOM Based XSS

the page itself (the HTTP response that is) does not change, but the client side code contained in the page executes differently due to the malicious modifications that have occurred in the DOM environment.

A classic example:

<p>Current URL: <script>document.write(window.location);</script></p>

Payload URL:

http://example.com/page.html#<script>alert(1)</script>

See how the payload is not found in the page source itself, but created from the browsers URL.

OWASP - Testing for Reflected Cross site scripting (OTG-INPVAL-001)

Reflected Cross-site Scripting (XSS) occur when an attacker injects browser executable code within a single HTTP response. [...] The attack string is included as part of the crafted URI or HTTP parameters, improperly processed by the application, and returned to the victim.

A classic example:

<p>Current URL: <?php echo $_SERVER['REQUEST_URI']; ?></p>

Payload URL:

http://example.com/page.php?<script>alert(1)</script>

See how the payload is in the page source itself, but from the URL passed to the PHP script.