Oh, sorry, there is some work to do still.

Tainting through the JS Parser seems to work (see the mochitest), however, transferring taints from the server does not (yet?).

Originally, this is done here, with mPipe having the type nsCOMPtr<nsIPipe>. This was possible due to changes to the nsIPipe interface. Back then, nsPipe did implement nsIPipe, i.e., here. The nsIPipe code has changed since, such that nsPipe no longer implements said interface. Instead we have an nsPipeHolder class that implements the nsIPipe interface, but only references the two end of the pipe.

Sooo, I think I got a workaround in place now. This adds another marker interface for streams that allow to set taints and the input stream can reach back into the nsPipe without having to expose it further.

The tests don't quite work as exptected, but you can see the taint getting returned from the server and passed along with:

MOZ_LOG=nsHttp:5 MOZ_UPLOAD_DIR=/tmp MOZ_HEADLESS=1 xvfb-run -- ./mach -v mochitest --headless taint/test/mochitest/test_end2end.html

oh, it seems to work (to some degree). If I set up a local server and transmit taints, the .textContent of divs is tainted at least. Nice :)

All windows builds are failing for this branch due to automatically enabling debugging flags, will look into that later today.

All windows builds are failing for this branch due to automatically enabling debugging flags, will look into that later today.

Do we need the DEBUG flags explicitly for end-2-end tainting, or is this enabled just during development?

This is just for development, so I'll disable them again.

Alternatively, we could consider moving that into a build system option similar to taintspew i think?

I think the textarea aspect is the only open point currently. I'd lean on disabling it, as I'm unsure of the rationale. Maybe disabling it via the preferences is the way to go, thinking about it.

The inline script sink will be a separate PR, as it breaks some tests at the moment, and I would prefer to look into that separately over the coming weeks.
It's mostly generating taint report events where the test does not expect them, so nothing major, but leaving it disabled might be the sane option atm.

Note that this will supersede #112