Skip to content

Propagate taint through StringIterator (fixes #348)#349

Merged
leeN merged 3 commits into
SAP:mainfrom
eleumasc:fix-348
Jan 7, 2026
Merged

Propagate taint through StringIterator (fixes #348)#349
leeN merged 3 commits into
SAP:mainfrom
eleumasc:fix-348

Conversation

@eleumasc

@eleumasc eleumasc commented Nov 10, 2025

Copy link
Copy Markdown
Contributor

This pull request enables taint propagation through StringIterator. Therefore, it fixes #348.

In local, we verified the following test cases:

  • Untainted string: - [..."abc"].map(x => x.taint)
  • Tainted string: [...String.tainted("abc", "t1")].map(x => x.taint)
  • Concatenation of tainted strings: [...(String.tainted("abc", "t1") + String.tainted("def", "t2"))].map(x => x.taint)
  • UTF-16 support: [..."a😊c"].map(x => x.taint)

@leeN

leeN commented Nov 11, 2025

Copy link
Copy Markdown
Collaborator

Looks good as far as I can see. Could you add a mochitest?

Generally, we apologize for the delay in merging PRs at the moment. We are currently busy preparing a Foxhound demo for Blackhat.

@eleumasc

eleumasc commented Nov 12, 2025

Copy link
Copy Markdown
Contributor Author

Here we go! I also replaced insert with setTaint, since the former caused a weird bug that led to overlapping taint ranges.

PS: I'm glad that you are going to present Foxhound to Blackhat. Unfortunately I will not be able to join the event for lack of funding :(

@leeN

leeN commented Nov 12, 2025

Copy link
Copy Markdown
Collaborator

Sadly, blackhat is super expensive... What is possible is to get a business hall ticket (it'll include the Arsenal stuff we are doing, but you are missing out on talks) so it is fairly cheap.. But still, it's like roughly 1k euros for flights (more expensive from italy I assume) and hotel..

@eleumasc

eleumasc commented Nov 13, 2025

Copy link
Copy Markdown
Contributor Author

Extra commit in which I copy the single-character string before setting the taint. I guess that strings of that kind are stored in a sort of cache, because when I executed the code [...(String.tainted("f", "t1") + String.tainted("o", "t2") + String.tainted("o", "t3"))].map(x => x.taint) the two "o"s got the same taint information, in particular the one assigned to the last "o". Couldn't detect this issue with the provided test cases :/

Comment thread js/src/builtin/String.js

@leeN leeN left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@leeN leeN merged commit d82b83e into SAP:main Jan 7, 2026
7 of 12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

No taint propagation through StringIterator

2 participants