search

SAP / project-foxhound

A web browser with dynamic data-flow tracking enabled in the Javascript engine and DOM, based on Mozilla Firefox (https://github.com/mozilla/gecko-dev). It can be used to identify insecure data flows or data privacy leaks in client-side web applications.
GNU General Public License v3.0
82 stars 16 forks source link

Add XHR response JSON Sink #80

Open tmbrbr opened 2 years ago

tmbrbr commented 2 years ago

At the moment we only taint XHR response bodies which are returned as text.

However, XHR responses can also contain JSON content: https://xhr.spec.whatwg.org/#the-response-attribute

In this case, we need to make sure that this function is marked as a source: https://github.com/SAP/project-foxhound/blob/main/dom/xhr/XMLHttpRequestMainThread.cpp#L631

And add a StringTaint argument to the JS_ParseJSON API.