ASVS 5.0 V3.2.3 requires that client side JavaScript avoids DOM clobbering by using explicit variable declarations, strict type checking, no global variables stored on the document object, and namespace isolation. It is a Level 3 requirement.
Why it matters
HTML elements with an id or name attribute become properties on window and document. If an attacker can inject harmless looking markup with no script, such as an anchor with id="config", code that reads window.config may pick up the element instead of the object it expected. That can redirect script loads or change security decisions, and it works even where a strict CSP blocks scripts.
How to implement it
Declare everything you use and never rely on an undeclared global.
"use strict";
const config = Object.freeze({ apiBase: "/api" }); // declared, not read from window
function getSettings(raw) {
if (typeof raw !== "object" || raw === null || raw instanceof Element) {
throw new TypeError("settings must be a plain object");
}
return raw;
}
Keep your code in modules or one namespace object, do not attach state to document, and check types before use, for example with instanceof or Array.isArray. Sanitize user supplied HTML so it cannot contain id or name attributes, which DOMPurify can do with its clobbering protection on.
How to test it
Inject elements such as a or form tags with id values that match global names your scripts read, then watch whether behaviour changes. Search the code for reads of bare globals and document. properties.
Common sinks to search for
Look for code that reads configuration or state from window.something, from document.something or from named form controls such as form.elements. Also check script loading code that builds a URL from a global. A search in CI for window. and document. property reads on non standard names helps find them. Prefer Object.hasOwn and Map for lookups keyed on user supplied names, so attacker names cannot collide with built in properties.
Common mistakes
- Using
if (window.debug)style checks on undeclared names. - Loading script URLs from a global configuration value.
Quick check
Does a strict CSP prevent DOM clobbering?
Not by itself. Clobbering uses plain HTML elements, not script, so the code must defend against it.
