📋 Overview
This page demonstrates all possible script variants for PCI DSS inventory testing, including:
- Inline Scripts - Embedded directly in HTML
- External Scripts - Loaded from external sources
- Security Headers - Various CSP and security configurations
- Script Attributes - Different attribute combinations
- Integration Types - Various ways scripts are integrated
📝 Inline Scripts
Inline Script #1 - Basic Analytics
- Integration Type: inline
- Purpose: Basic page analytics tracking
- Security: No integrity hash
<script>
// Basic analytics tracking
console.log('Page loaded:', window.location.href);
const pageLoadTime = Date.now();
localStorage.setItem('lastVisit', pageLoadTime);
</script>
Inline Script #2 - Payment Form Validation
- Integration Type: inline
- Purpose: Payment form validation logic
- Security: No integrity hash
<script>
function validatePaymentForm() {
const cardNumber = document.getElementById('cardNumber').value;
const expiry = document.getElementById('expiry').value;
if (!cardNumber || cardNumber.length !== 16) {
alert('Invalid card number');
return false;
}
if (!expiry || !/^\d{2}\/\d{2}$/.test(expiry)) {
alert('Invalid expiry date');
return false;
}
return true;
}
</script>
Inline Script #3 - Security Token Generation
- Integration Type: inline
- Purpose: CSRF token generation
- Security: No integrity hash
<script>
// Generate CSRF token for form submission
function generateCSRFToken() {
const token = Math.random().toString(36).substring(2, 15) +
Math.random().toString(36).substring(2, 15);
document.getElementById('csrfToken').value = token;
return token;
}
// Auto-generate on page load
document.addEventListener('DOMContentLoaded', generateCSRFToken);
</script>
🔗 External Scripts
External Script #1 - Stripe.js (with integrity)
- Integration Type: external
- Source: https://js.stripe.com/v3/
- Purpose: Payment processing
- Security: Has integrity hash
<script
src="https://js.stripe.com/v3/"
integrity="sha384-abc123def456ghi789jkl012mno345pqr678stu901vwx234yz567abc890def123"
crossorigin="anonymous">
</script>
External Script #2 - Google Analytics (no integrity)
- Integration Type: external
- Source: https://www.googletagmanager.com/gtag/js
- Purpose: Analytics tracking
- Security: No integrity hash
<script
src="https://www.googletagmanager.com/gtag/js?id=GA_MEASUREMENT_ID"
async>
</script>
External Script #3 - Custom Widget (with attributes)
- Integration Type: external
- Source: https://cdn.example.com/widget.js
- Purpose: Custom payment widget
- Security: Has integrity hash and attributes
<script
src="https://cdn.example.com/widget.js"
integrity="sha384-def456ghi789jkl012mno345pqr678stu901vwx234yz567abc890def123ghi456"
crossorigin="anonymous"
defer
data-widget-id="payment-form"
data-environment="production">
</script>
External Script #4 - jQuery (legacy, no security)
- Integration Type: external
- Source: https://code.jquery.com/jquery-3.6.0.min.js
- Purpose: DOM manipulation library
- Security: No integrity hash, no crossorigin
<script src="https://code.jquery.com/jquery-3.6.0.min.js"></script>
⚡ Dynamic Script Loading
Dynamic Script #1 - Conditional Loading
- Integration Type: external (dynamic)
- Purpose: Load scripts based on user preferences
- Security: No integrity hash
<script>
// Dynamically load scripts based on user preferences
function loadUserPreferences() {
const userPrefs = localStorage.getItem('userPreferences');
if (userPrefs && JSON.parse(userPrefs).analytics) {
const script = document.createElement('script');
script.src = 'https://cdn.example.com/analytics.js';
script.async = true;
document.head.appendChild(script);
}
}
document.addEventListener('DOMContentLoaded', loadUserPreferences);
</script>
Dynamic Script #2 - Feature Detection
- Integration Type: external (dynamic)
- Purpose: Load polyfills when needed
- Security: No integrity hash
<script>
// Load polyfills for older browsers
if (!window.Promise) {
const script = document.createElement('script');
script.src = 'https://cdn.polyfill.io/v2/polyfill.min.js';
script.integrity = 'sha384-xyz789abc123def456ghi789jkl012mno345pqr678stu901vwx234yz567abc890';
script.crossOrigin = 'anonymous';
document.head.appendChild(script);
}
</script>
🛡️ Security Headers & CSP
Content Security Policy
Current Policy: Restrictive CSP with script-src limitations
default-src 'self';
script-src 'self' 'unsafe-inline' https://cdn.example.com https://js.stripe.com;
style-src 'self' 'unsafe-inline';
X-Frame-Options
Value: DENY
Prevents clickjacking attacks
X-Content-Type-Options
Value: nosniff
Prevents MIME type sniffing
Referrer Policy
Value: strict-origin-when-cross-origin
Controls referrer information
🏷️ Script Attributes
Security Attributes
integrity- SRI hash verificationcrossorigin- CORS handlingreferrerpolicy- Referrer control
Loading Attributes
async- Asynchronous loadingdefer- Deferred executiontype- Script type specification
Custom Attributes
data-*- Custom data attributesid- Element identificationclass- CSS class assignment
📊 PCI DSS Compliance Status
Script Inventory
Total Scripts: 21
Main Page Scripts: 15
Iframe Scripts: 6
Inline Scripts: 5 (3 main + 2 iframe)
External Scripts: 16 (12 main + 4 iframe)
With Integrity: 4 (3 main + 1 iframe)
Without Integrity: 17 (12 main + 5 iframe)
Security Status
OK Content Security Policy
OK X-Frame-Options
OK X-Content-Type-Options
CHANGED Some scripts modified
Review Required
NEW 2 new scripts detected
CHANGED 1 script modified
MISSED 1 authorized script missing
🖼️ Iframe with Embedded Scripts
Iframe Content - Nested Scripts
- Integration Type: iframe with inline and external scripts
- Purpose: Demonstrate nested script detection
- Security: Mixed security levels within iframe
<iframe
src="data:text/html;base64,PHNjcmlwdD5jb25zb2xlLmxvZygnSWZyYW1lIGxvYWRlZCcpOzwvc2NyaXB0Pgo8c2NyaXB0IHNyYz0iaHR0cHM6Ly9jZG4uZXhhbXBsZS5jb20vaWZyYW1lLXNjcmlwdC5qcyI+PC9zY3JpcHQ+CjxkaXYgaWQ9ImlmcmFtZS1jb250ZW50Ij5JZnJhbWUgQ29udGVudCB3aXRoIFNjcmlwdHM8L2Rpdj4KPHNjcmlwdD4KICAvLyBJbmxpbmUgc2NyaXB0IGluc2lkZSBpZnJhbWUKICBmdW5jdGlvbiBpZnJhbWVGdW5jdGlvbigpIHsKICAgIGNvbnNvbGUubG9nKCdJZnJhbWUgZnVuY3Rpb24gZXhlY3V0ZWQnKTsKICAgIGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCdpZnJhbWUtY29udGVudCcpLmlubmVySFRNTCA9ICdVcGRhdGVkIGJ5IGlmcmFtZSBzY3JpcHQhJzsKICB9CiAgCiAgLy8gQ2FsbCBmdW5jdGlvbiBhZnRlciBsb2FkaW5nCiAgc2V0VGltZW91dChpZnJhbWVGdW5jdGlvbiwgMTAwMCk7Cjwvc2NyaXB0Pgo8c2NyaXB0IHNyYz0iaHR0cHM6Ly9jZG4uanNkZWxpdnIubmV0L25wbS9qcXVlcnlAMy42LjAvanF1ZXJ5Lm1pbi5qcyI+PC9zY3JpcHQ+CjxkaXYgaWQ9InZ1ZS1hcHAiPjwvZGl2Pgo8c2NyaXB0IHR5cGU9Im1vZHVsZSI+CiAgLy8gVnVlLmpzIG1vZHVsZSBpbnNpZGUgaWZyYW1lCiAgaW1wb3J0IHsgY3JlYXRlQXBwIH0gZnJvbSAnaHR0cHM6Ly91bnBrZy5jb20vdnVlQDNkaXN0L3Z1ZS5lc20tYnJvd3Nlci5qcyc7CiAgCiAgY29uc3QgaWZyYW1lQXBwID0gY3JlYXRlQXBwKHsKICAgIGRhdGEoKSB7CiAgICAgIHJldHVybiB7CiAgICAgICAgbWVzc2FnZTogJ0lmcmFtZSBWdWUuanMgbG9hZGVkIScKICAgICAgfTsKICAgIH0KICB9KTsKICAKICBpZnJhbWVBcHAubW91bnQoJyN2dWUtYXBwJyk7Cjwvc2NyaXB0Pgo8c2NyaXB0PgogIC8vIER5bmFtaWMgc2NyaXB0IGxvYWRpbmcgaW5zaWRlIGlmcmFtZQogIGZ1bmN0aW9uIGxvYWRJZnJhbWVTcmlwdCgpIHsKICAgIGlmICh3aW5kb3cuanF1ZXJ5KSB7CiAgICAgIGNvbnNvbGUubG9nKCdKUXVlcnkgbG9hZGVkIGluc2lkZSBpZnJhbWUnKTsKICAgICAgCiAgICAgIC8vIExvYWQgYWRkaXRpb25hbCBzY3JpcHQgZHluYW1pY2FsbHkKICAgICAgY29uc3Qgc2NyaXB0ID0gZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgnc2NyaXB0Jyk7CiAgICAgIHNjcmlwdC5zcmMgPSAnaHR0cHM6Ly9jZG4uZXhhbXBsZS5jb20vaWZyYW1lLWR5bmFtaWMuanMnOwogICAgICBzY3JpcHQuaW50ZWdyaXR5ID0gJ3NoYTM4NC1hYmMxMjNkZWY0NTZnaGk3ODlqa2wwMTJtbm8zNDVwcXI2NzhzdHU5MDF2d3gyMzR5ejo1NjdhYmM4OTBkZWYxMjNoaWQ0NTYnOwogICAgICBzY3JpcHQuY3Jvc3NPcmlnaW4gPSAnYW5vbnltb3VzJzsKICAgICAgZG9jdW1lbnQuaGVhZC5hcHBlbmRDaGlsZChzY3JpcHQpOwogICAgfQogIH0KICAKICAvLyBMb2FkIGFmdGVyIGFsbCBzY3JpcHRzIGFyZSBsb2FkZWQKICB3aW5kb3cuYWRkRXZlbnRMaXN0ZW5lcignbG9hZCcsIGxvYWRJZnJhbWVTcmlwdCk7Cjwvc2NyaXB0Pg=="
width="100%"
height="400"
style="border: 2px solid #3498db; border-radius: 8px;"
title="Iframe with embedded scripts for testing"
sandbox="allow-scripts allow-same-origin"
loading="lazy">
Iframe Script Contents (Base64 Decoded):
- Inline Script #1: Console log on iframe load
- External Script #1: https://cdn.example.com/iframe-script.js
- Inline Script #2: Function to update iframe content
- External Script #2: jQuery 3.6.0 from CDN
- Module Script: Vue.js ES6 module import
- Dynamic Script: Dynamically loaded script with integrity
Iframe Security Features:
- Sandbox: allow-scripts allow-same-origin
- Loading: lazy loading for performance
- Title: Descriptive title for accessibility
- Styling: Visual border and rounded corners
🌐 Iframe
External Website Iframe
- Integration Type: cross-origin iframe
- Purpose: Test external website script detection
- Security: Cross-origin restrictions apply
- Content: Live test-deep-link-app website
<iframe
src="https://example.com"
width="100%"
height="400"
style="border: 2px solid #e74c3c; border-radius: 8px;"
title="Example.com iframe for cross-origin testing"
loading="lazy"
referrerpolicy="no-referrer">
</iframe>
Cross-Origin Iframe Features:
- Source: https://dtelega.github.io/
- Referrer Policy: no-referrer
- Loading: lazy loading for performance
- Styling: Red border to distinguish from embedded iframe
- Purpose: Test how inspector handles external website content
Expected Behavior:
- Cross-Origin Restrictions: Same-origin policy will limit access
- Script Detection: May not be able to inspect internal scripts
- Security: Demonstrates real-world iframe limitations
- Testing: Shows inspector's behavior with external content
- Content: Test Deep Link App with "Simulate Error" and "Simulate Success" buttons
🧪 Testing Instructions
For PCI Scripts Inspector Testing:
- Scan this page using the PCI Scripts Inspector service
- Verify script detection - should find all 21 scripts (15 + 6 iframe)
- Check integration types - inline vs external vs iframe
- Validate security headers - CSP, X-Frame-Options, etc.
- Test integrity hashes - some scripts have SRI, others don't
- Verify attributes - crossorigin, async, defer, etc.
- Check dynamic loading - scripts loaded via JavaScript
- Test iframe handling - nested script detection within iframes
Expected Results:
- InspectionJob Status: Should complete successfully
- Script Count: 21 total scripts detected (15 main + 6 iframe)
- Security Headers: All major security headers present
- Report Generation: Should create detailed report with script analysis
- Iframe Detection: Should detect scripts within iframe content