Patent Document ID: 9754113
Application ID: 15034363
Patent Status: 1

Claim One:
1. A method for detecting a document object model based cross-site scripting vulnerability, comprising: obtaining a set of parameter-value pairs from an original web address of a web page, wherein the set of parameter-value pairs comprises at least one parameter-value pair; replacing a parameter value in a parameter-value pair with feature code, to form a test web address for the web page, wherein the feature code comprises malicious code that comprises a malicious character and is uniquely identified in a document object model tree of the web page; obtaining page content corresponding to the test web address by: requesting a web server of the test web address for page content corresponding to the test web address; and receiving the page content responded by the web server of the test web address; converting the page content, into the document object model tree; and detecting whether a cross-site scripting vulnerability exists in the parameter-value pair, based on the document object model tree and the feature code by: determining whether the document object model tree comprises the feature code; determining that a cross-site scripting vulnerability exists in the parameter-value pair if the document object model tree comprises the feature code; determining that no cross-site scripting vulnerability exists in the parameter-value pair if the document object model tree does not comprise the feature code; and in a case that the document object model tree does not comprise the feature code: triggering execution of a button on the web page; updating the document object model tree; and detecting whether a cross-site scripting vulnerability exists in the parameter-value pair based on the updated document object model tree and the feature code.