X-Taint Header does not expect or accept compliant JSON

[leeN]

The X-Taint Header looks like it is JSON, i.e., X-Taint: [{ begin: 4, end: 8, source: "e2e" }, { begin: 17, end: 20, source: "e2e" }] but it has a key difference to real JSON. It only accepts unquoted keys, i.e., JSON.stringify(taints) will not produce a valid value for the X-Taint header.

A helper function to transform it into the pseudo JSON is, e.g., the following:

function formatXTaintEntry(taint) {
  let entries = [];
  if(Object.hasOwn(taint, "begin")) {
    entries.push(`begin: ${taint.begin}`);
  } else {
    throw new Error("Missing begin key");
  }
  if(Object.hasOwn(taint, "end")) {
    entries.push(`end: ${taint.end}`);
  } else {
    throw new Error("Missing end key");
  }
  if(Object.hasOwn(taint, "source")) {
    entries.push(`source: "${taint.source}"`);
  } else {
    throw new Error("Missing source key");
  }
  return `{ ${entries.join(", ")} }`;
}

function formatXTaint(taints) {
  let xtaint_entries = [];
  for(const taint of taints) {
    xtaint_entries.push(formatXTaintEntry(taint));
  }
  return `[${xtaint_entries.join(", ")}]`;
}

This is just an inconvenience, but I plan to resolve this by changing the parser for Taint Ranges to accept either format after submission of my dissertation. As I am currently probably the only user of this feature, and this should remain backwards compatible if someone adopts it, this should only make life easier for any user.

[tmbrbr]

This definitely makes sense to have a JSON compatible format. It's not the most efficient in terms of size etc, but I think that is compensated by the convenience factor.

[leeN]

The size delta is 6 characters per entry in the array anyway, unless we decide to transmit location information, which might not be uninteresting, i think this effectively does not matter even for toy websites.

Currently received e2e taints have some default (all zero, as cropped up in a different issue) TaintLocation which is not overly meaningful.

[leeN]

But i commit to fixing this at latest on September! If we add more information that should probably be an unrelated issue, but I'm not quite sure whether/how feasible this is, due to lack of actual backends.