Skip to content

Instantly share code, notes, and snippets.

@g-k

g-k/taint-tracking.md

Last active October 7, 2016 03:03
Show Gist options
  • Save g-k/6a69edd028ddc5426391a74b45307cbd to your computer and use it in GitHub Desktop.
Save g-k/6a69edd028ddc5426391a74b45307cbd to your computer and use it in GitHub Desktop.
Download ZIP
Raw
taint-tracking.md

Taint checking / analysis for Javascript might be coming to Flow: https://www.youtube.com/watch?v=VEaDsKyDxkY&t=24m45s

It'd be great to extend that to the browser and backend for QA and security.

The wikipedia page links to http://docstore.mik.ua/orelly/web/jscript/ch20_04.html which says Netscape Navigator 3 and 4 used taint-tracking to prevent exfiltrating private data too.

Actually per https://queue.acm.org/detail.cfm?id=2663760 just escape output for the appropriate context or contexts (i.e. what we already know), but Flow could be helpful there too for finding unescaped output/sinks.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment