SAP / project-foxhound

A web browser with dynamic data-flow tracking enabled in the Javascript engine and DOM, based on Mozilla Firefox (https://github.com/mozilla/gecko-dev). It can be used to identify insecure data flows or data privacy leaks in client-side web applications.
GNU General Public License v3.0
80 stars 15 forks source link

Tainting Uint8Array #215

Open leeN opened 5 months ago

leeN commented 5 months ago

When using Foxhound with data coming from WebAssembly, one data type we have to deal with is Uint8(Array). Currently, we are losing taints here, e.g., like this:

const x = new Uint8Array([Number.tainted(1), Number.tainted(2)]);
console.assert(x[0].taint, "noooooo")
// Assertion failed: ...

This was originally reported by @0drai.