Updated the "Hidden Input Field Detection at Response Level (Passive)" Finding

[LabMC]

Overview

• CONTEXT: The purpose of this request is to update the "vulnerability-classes/injection/Detecting hidden input fields for XSS.bcheck" URL.
  • I wanted to create a BCheck which checks for hidden XSS fields based on: https://portswigger.net/research/exploiting-xss-in-hidden-inputs-and-meta-tags
• The current version of this bcheck only checks if <input> has type="hidden" as its very first attribute.
• The current version of this bcheck also does not consider hidden fields via style="display: none;"
• I've also provided additions to the detail & remediation text which provides an easy example for how users should test Hidden Input findings for XSS.

Ask: As this is a significant update to a pre-existing bcheck file, please let me know what the correct syntax is for multiple authors.

BCheck Contributions

• BCheck compiles and executes as expected
• BCheck contains appropriate metadata (name, version, author, description and appropriate tags)
• Only .bcheck files have been added or modified
• BCheck is in the appropriate folder
• PR contains single or limited number of BChecks (Multiple PRs are preferred)
• BCheck attempts to minimize false positives

[Hannah-PortSwigger]

Thank you for the additional validation that you've added to this BCheck.

We have some feedback around the styling of the issue detail and remediation advice to make this easier to read.

[PortSwiggerWiener]

Looks good 👍