search

filedescriptor / untrusted-types

Apache License 2.0
655 stars 71 forks source link

More filtering options #5

Closed caioluders closed 3 years ago

caioluders commented 3 years ago

Hello @filedescriptor! Amazing tool!

I've been using it for the past couple weeks and notice that would be nice if the tool had more filtering options. For example, many times a website I'm auditing uses some complex framework that calls more than 20 functions before reaching the sink. Or the website uses some Google's tracking that I don't care about, and stuff like that.

So I coded those options. The main functionalities are an upper limit of calls before reaching the sink, anything above that limit will not be logged , and two filter lists to ignore sinks that passes or are originated from a domain/file.

I used a settings.json file to store those options, and made a synchronous call to the file as a way of bypass the chrome.storage limitation, I don't think this impacts the tool's perfomance.

I'm more than open to any criticism and you can use the pull as you wish.

Thanks ^^

filedescriptor commented 3 years ago

First, thanks for using the extension and being the first contributor! I was also thinking some kind of filtering feature since there's a lot of noise generated as you pointed out. I like the filter options you added!

I'll do some testing and fix some coding style issues and merge this request.