SAP / project-foxhound

A web browser with dynamic data-flow tracking enabled in the Javascript engine and DOM, based on Mozilla Firefox (https://github.com/mozilla/gecko-dev). It can be used to identify insecure data flows or data privacy leaks in client-side web applications.
GNU General Public License v3.0
80 stars 15 forks source link

Update to Playwright 1.42 #205

Closed tmbrbr closed 8 months ago

tmbrbr commented 8 months ago

This PR merges the upstream firefox version:

cla-assistant[bot] commented 8 months ago

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 22 committers have signed the CLA.

:white_check_mark: tmbrbr
:x: jfkthame
:x: calumozilla
:x: Cieara Meador
:x: longsonr
:x: yurydelendik
:x: glandium
:x: nchevobbe
:x: karlt
:x: chutten
:x: jensstutte
:x: wisniewskit
:x: CosminSabou
:x: janvarga
:x: jcristau
:x: aosmond
:x: yjugl
:x: allstarschh
:x: jonco3
:x: saschanaz
:x: bhearsum
:x: Rob--W


Cieara Meador seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
You have signed the CLA already but the status is still pending? Let us recheck it.

tmbrbr commented 8 months ago

There were a few things to fix in this PR, mainly there were some crashes related to the garbage collection / double free of some strings.

For Strings created in the Nursery, the memory is not explicitly freed during a garbage collection, the long-lived strings are migrated, and the entire Nursery is zapped. As the tainting information is managed separately, we need to explicitly free it during a sweep. This was working but had been removed a few versions ago.

I also found a case where inline strings were created as dependent strings where a lack of GC blocking was causing problems.

tmbrbr commented 8 months ago

There still seems to be some memory related crashes which need to be fixed before this PR can be submitted.