Open Issues Need Help
View All on GitHubAI Summary: The task is to improve the X-Taint header in the Foxhound browser by modifying the Taint Ranges parser (Taint.cpp) to accept both the current unquoted key format and standard JSON format for taint information. This involves updating the parser to handle quoted keys and ensuring backward compatibility with existing code.
A web browser with dynamic data-flow tracking enabled in the Javascript engine and DOM, based on Mozilla Firefox (https://github.com/mozilla-firefox/firefox). It can be used to identify insecure data flows or data privacy leaks in client-side web applications.
AI Summary: The task is to modify the Foxhound browser's taint tracking mechanism to include the target origin as an argument in the taint operation details for `window.postMessage` events. Currently, the target origin is reported as `null`, but the enhancement should accurately reflect the actual target origin used in the `postMessage` call.
A web browser with dynamic data-flow tracking enabled in the Javascript engine and DOM, based on Mozilla Firefox (https://github.com/mozilla-firefox/firefox). It can be used to identify insecure data flows or data privacy leaks in client-side web applications.
AI Summary: The task requires modifying the Foxhound browser's taint tracking mechanism to include the `oldURL` and `newURL` properties of the `HashChangeEvent` object as potential taint sources. This ensures that changes to the URL hash, potentially triggered by malicious actors, are correctly flagged as tainted, improving the accuracy of data-flow tracking and security analysis.
A web browser with dynamic data-flow tracking enabled in the Javascript engine and DOM, based on Mozilla Firefox (https://github.com/mozilla-firefox/firefox). It can be used to identify insecure data flows or data privacy leaks in client-side web applications.
AI Summary: The task is to enhance the Foxhound browser's taint tracking functionality. Specifically, the `fetch` and `WebSocket` taint operations need to be updated to include request arguments (URL, headers, etc.) in their taint reports, mirroring the existing functionality of `XMLHttpRequest`. This will improve the accuracy and detail of data flow tracking, making it easier to identify insecure data flows.
A web browser with dynamic data-flow tracking enabled in the Javascript engine and DOM, based on Mozilla Firefox (https://github.com/mozilla-firefox/firefox). It can be used to identify insecure data flows or data privacy leaks in client-side web applications.