Web Application Security Enhancement through DOM-based XSS Vulnerabilities Detection in Multi-File Environments

Oct 13, 2026

Upload by Damian

Modern web applications built on multi-file frameworks like Laravel introduce complex file structures that hinder reliable detection of DOM-based Cross-Site Scripting (XSS) vulnerabilities. The paper presents a hybrid framework combining enhanced static and dynamic analysis to increase detection accuracy. PHP-Parser and Semgrep were extended with new modules to improve performance and reduce false positives and false negatives. Evaluation on nine real-world Laravel applications shows improved results versus Espree.

LanguageEnglish

CategoryGeneral

FormatPDF

Pages13

Reading Time5 min

AccessFree to download

INTRODUCTION

DOM-based XSS and its attack mechanism

Detection complexity across environments

Static vs dynamic analysis and evaluation challenges

Web Application Security Enhancement through DOM-based XSS Vulnerabilities Detection in Multi File Environments Omar AL-Zamar (1*) Basheer Al-Tayar (2,3) Sabri Saeed (3) Zakriya N. M. Alhaj (4) Received: 12/06/2026 Revised: 16/07/2026 Accepted: 17/07/2026 © 2026 University of Science and Technology, Aden , Yemen. This article can be distributed under the terms of the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original author and source are credited. 2026 © 1 Department of Information Technology, Faculty of Engineering and IT, Taiz University, Taiz, Yemen. 2 Department of Information Technology, Faculty of Computer & Information technology, Taiz University, Taiz, Yemen. 3 Department of Information Technology and Cybersecurity, Al Janad University for Science and Technology, Taiz, Yemen. 4 Department of Communications and Computer Engineering, Faculty of Engineering and IT, Taiz University, Taiz, Yemen *Corresponding Author’s Email: [omar.abdulqawi@taiz.edu.ye](omar.abdulqawi@taiz.edu.ye) Web Application Security Enhancement through DOM-based XSS Vulnerabilities Detection in Multi-File Environments Omar AL-Zamar1,5*, Basheer Al-Tayar2,3, Sabri Saeed3,6, Zakriya N. M. Alhaj4 1 Department of Information Technology, Faculty of Engineering and IT, Taiz University, Taiz, Yemen. 2 Department of Information Technology, Faculty of Computer & Information technology, Taiz University, Taiz, Yemen. 3 Department of Information Technology and Cybersecurity, Al Janad University for Science and Technology, Taiz, Yemen. 4Department of Communications and Computer Engineering, Faculty of Engineering and IT, Taiz University, Taiz, Yemen [omar.abdulqawi@taiz.edu.ye](omar.abdulqawi@taiz.edu.ye5)[5](omar.abdulqawi@taiz.edu.ye5), [basheer.altayar@taiz.edu.ye](basheer.altayar@taiz.edu.ye2)[2](basheer.altayar@taiz.edu.ye2), [Sabri.alshibany@just.edu.ye](Sabri.alshibany@just.edu.ye6)[6](Sabri.alshibany@just.edu.ye6), [ziko1994132@gmail.com](ziko1994132@gmail.com4)[4](ziko1994132@gmail.com4) Abstract— Modern web applications built on multi-file frameworks such as Laravel contain complex file structures that present major obstacles to detecting DOM-based CrossSite Scripting (XSS) vulnerabilities. This paper proposes a hybrid framework that integrates static and dynamic analysis to improve detection accuracy. PHP-Parser and Semgrep tools were enhanced by adding new modules, thereby improving analysis performance and reducing potential risks. The evaluation of nine real-world Laravel applications demonstrated high detection accuracy with a significant reduction in false positives and false negatives, outperforming prior tools, such as Espree. Additionally, adataset of DOM-based XSS vulnerabilities in modern web applications is created and can be used for further evaluation and research. Keywords— DOM-based XSS, Laravel, multi-file environments, static and dynamic analysis, vulnerabilities. INTRODUCTION Web applications are widely employed in modern digital infrastructure. in modern digital infrastructure. However, the evolution of web technologies has introduced new security threats [1] . Cross-Site Scripting (XSS) is one of the most common vulnerabilities in web applications. It may lead to attacks such as theft of sensitive information, user impersonation, or the execution of malicious commands on users’ devices. XSS attacks, encompassing stored, reflected, and DOM-based types, follow a shared principle. However, they differ in their processing location and execution mechanism. Specifically, DOM-based XSS occurs entirely within the browser environment. The attacker injects malicious JavaScript code into the URL, and when the user opens the page, the script is executed, which may allow the attacker to manipulate or modify transmitted data without authorization. The process by which an attacker introduces malicious code is

FAQs

What problem does the paper address for DOM-based XSS detection in multi-file frameworks?

Multi-file structures in frameworks like Laravel distribute sources and sinks across files and languages, making both static and dynamic analysis harder and reducing detection reliability.

How does the proposed framework improve DOM-based XSS detection accuracy?

It integrates enhanced static and dynamic analysis. The paper extends PHP-Parser and Semgrep with new modules to improve analysis performance and reduce false results.

What evaluation results are reported for the proposed approach?

Testing on nine real-world Laravel applications demonstrates high detection accuracy, with a significant reduction in false positives and false negatives compared with prior tools such as Espree.

Oct 13, 2026

Upload by Damian