The fetch.header(value), fetch.text(), fetch.json(), and WebSocket.MessageEvent.data taint operations do not have arguments about the request, but XMLHttpRequest.send and XMLHttpRequest.response do.
Expected
{
"operation": "fetch.text()",
"builtin": true,
"source": true,
"location": { ... },
"arguments": [
"https://example.org/a.json",
"Content-Type: application/x-www-form-urlencoded\r\n",
"content-length: 96\r\ncontent-type: application/json; charset=utf-8\r\n"
]
}
Actual
{
"operation": "fetch.text()",
"builtin": true,
"source": true,
"location": { ... },
"arguments": []
}
The fetch.header(value), fetch.text(), fetch.json(), and WebSocket.MessageEvent.data taint operations do not have arguments about the request, but XMLHttpRequest.send and XMLHttpRequest.response do.
Expected
Actual