LocalStorage Taint Arguments not Provided

[tmbrbr]

The normal way to access localstorage objects is via getters and setters:

localStorage.setItem('myCat', 'Tom');

and

const cat = localStorage.getItem('myCat');

But as described here, it is also possible via properties and array like access:

localStorage.colorSetting = '#a4509b';
localStorage['colorSetting'] = '#a4509b';
localStorage.setItem('colorSetting', '#a4509b');

In foxhound, the correct function argument is not always reported when using the direct properties access.

[tmbrbr]

Double checking, it appears that even the getters and setters and not providing the correct taint arguments.

[tmbrbr]

Added the storage key as a taint argument here: https://github.com/SAP/project-foxhound/commit/2b34d394ed8672fbc6433cf23cd6cab7cb65f18e