A web browser with dynamic data-flow tracking enabled in the Javascript engine and DOM, based on Mozilla Firefox (https://github.com/mozilla/gecko-dev). It can be used to identify insecure data flows or data privacy leaks in client-side web applications.
I have noticed that the taint gets lost with btoa strings when using classes. Below is the code to reproduce it. Clientx and Clienty are marked as taint sources.
When you click on the page, both the setItems will report the taint flows. But after the first click, every subsequent click will only report the setItem from the jsonString will report a taint flow, the encoded2 will not report the taint flow. This only happens to strings that have gone through the btoa builtin function (from what I can tell). This also happens only with classes (all different ways of creating classes) from what I can tell.
I have noticed that the taint gets lost with btoa strings when using classes. Below is the code to reproduce it. Clientx and Clienty are marked as taint sources.
When you click on the page, both the setItems will report the taint flows. But after the first click, every subsequent click will only report the setItem from the
jsonString
will report a taint flow, theencoded2
will not report the taint flow. This only happens to strings that have gone through the btoa builtin function (from what I can tell). This also happens only with classes (all different ways of creating classes) from what I can tell.