Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -114,8 +114,8 @@ The JavaScript public API (jsapi.h) has been extended to support access to taint
`JS_ReportTaintSink` which takes care of reporting a flow of tainted data into a predefined sink.
In this case a message will be written to stdout and a custom JavaScript Event will be triggered that can then be processed by a Firefox extension.

All code related to taint tracking has been marked with a `// TaintFox` comment, making it easy to search for modifications in the source code.
Finding the `location.hash` taint source becomes as easy as `git grep -n TaintFox | grep location.hash`.
All code related to taint tracking has been marked with a `// Foxhound` comment, making it easy to search for modifications in the source code.
Finding the `location.hash` taint source becomes as easy as `git grep -n Foxhound | grep location.hash`.

Taint information is available in JavaScript via the `.taint` property of string instances:

Expand Down
4 changes: 2 additions & 2 deletions dom/base/CharacterData.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -143,7 +143,7 @@ void CharacterData::GetData(nsAString& aData) const {
}
}

// TaintFox: propagate taint when accessing text data from DOM nodes.
// Foxhound: propagate taint when accessing text data from DOM nodes.
aData.AssignTaint(mText.Taint());

}
Expand Down Expand Up @@ -181,7 +181,7 @@ void CharacterData::SubstringData(uint32_t aStart, uint32_t aCount,
CopyASCIItoUTF16(Substring(data, data + amount), aReturn);
}

// TaintFox: propagate taint.
// Foxhound: propagate taint.
aReturn.AssignTaint(mText.Taint().safeSubTaint(aStart, aStart + aCount));
}

Expand Down
2 changes: 1 addition & 1 deletion dom/base/DOMParser.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -61,7 +61,7 @@ NS_IMPL_CYCLE_COLLECTING_RELEASE(DOMParser)
already_AddRefed<Document> DOMParser::ParseFromString(const nsAString& aStr,
SupportedType aType,
ErrorResult& aRv) {
// TaintFox: Copy String so the TaintOperation shows up in the function trace
// Foxhound: Copy String so the TaintOperation shows up in the function trace
nsTDependentSubstring strCopy(aStr, 0);
// TODO(david): Is this sound?
nsTArray<nsString> args;
Expand Down
12 changes: 6 additions & 6 deletions dom/base/Document.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -6418,7 +6418,7 @@ void Document::GetReferrer(nsACString& aReferrer) const {

URLDecorationStripper::StripTrackingIdentifiers(referrer, aReferrer);

// TaintFox: document.referrer taint source.
// Foxhound: document.referrer taint source.
MarkTaintSource(aReferrer, "document.referrer");
}

Expand Down Expand Up @@ -6464,7 +6464,7 @@ void Document::GetCookie(nsAString& aCookie, ErrorResult& aRv) {
// because it assumes that the input is valid.
UTF_8_ENCODING->DecodeWithoutBOMHandling(cookie, aCookie);

// TaintFox: document.cookie source.
// Foxhound: document.cookie source.
MarkTaintSource(aCookie, "document.cookie");
}
}
Expand Down Expand Up @@ -6509,7 +6509,7 @@ void Document::SetCookie(const nsAString& aCookie, ErrorResult& aRv) {
return;
}

// TaintFox: document.cookie sink.
// Foxhound: document.cookie sink.
ReportTaintSink(aCookie, "document.cookie");

NS_ConvertUTF16toUTF8 cookie(aCookie);
Expand Down Expand Up @@ -10033,7 +10033,7 @@ void Document::WriteCommon(const nsAString& aText, bool aNewlineTerminate,
}
}

// TaintFox: document.write and document.writeln sink.
// Foxhound: document.write and document.writeln sink.
ReportTaintSink(aText, aNewlineTerminate ? "document.writeln" : "document.write");

static constexpr auto new_line = u"\n"_ns;
Expand Down Expand Up @@ -10116,7 +10116,7 @@ nsresult Document::GetDocumentURI(nsString& aDocumentURI) const {

CopyUTF8toUTF16(uri, aDocumentURI);

// TaintFox: document.documentURI taint source.
// Foxhound: document.documentURI taint source.
MarkTaintSource(aDocumentURI, "document.documentURI");
} else {
aDocumentURI.Truncate();
Expand Down Expand Up @@ -10144,7 +10144,7 @@ void Document::GetDocumentURIFromJS(nsString& aDocumentURI,
}
CopyUTF8toUTF16(uri, aDocumentURI);

// TaintFox: document.documentURI taint source.
// Foxhound: document.documentURI taint source.
MarkTaintSource(aDocumentURI, "document.documentURI");
}

Expand Down
20 changes: 10 additions & 10 deletions dom/base/Element.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -234,7 +234,7 @@ namespace mozilla::dom {

// Note that mozjemalloc uses a 16 byte quantum, so 64, 80 and 128 are
// bucket sizes.
// Taintfox - originally ASSERT_NODE_SIZE(Element, 128, 80);
// Foxhound - originally ASSERT_NODE_SIZE(Element, 128, 80);
// We needed to add additional 8 bytes for taint operations
ASSERT_NODE_SIZE(Element, 136, 80);
ASSERT_NODE_SIZE(HTMLDivElement, 136, 80);
Expand All @@ -243,7 +243,7 @@ ASSERT_NODE_SIZE(HTMLParagraphElement, 136, 80);
ASSERT_NODE_SIZE(HTMLPreElement, 136, 80);
ASSERT_NODE_SIZE(HTMLSpanElement, 136, 80);
ASSERT_NODE_SIZE(HTMLTableCellElement, 136, 80);
// TaintFox:
// Foxhound:
// Original: ASSERT_NODE_SIZE(Text, 120, 64);
// Text is now a taintable string, so contains an
// additional pointer (ie 120 + 8 or 64 + 4 bytes)
Expand Down Expand Up @@ -2436,7 +2436,7 @@ void Element::SetEventHandler(nsAtom* aEventName, const nsAString& aValue,
return;
}

// TaintFox: Event handler sink.
// Foxhound: Event handler sink.
if (aValue.isTainted()) {
nsAutoString eventName;
aEventName->ToString(eventName);
Expand Down Expand Up @@ -2579,7 +2579,7 @@ nsresult Element::SetAttr(int32_t aNamespaceID, nsAtom* aName, nsAtom* aPrefix,
nsAttrValue oldValue;
bool oldValueSet;

// Taintfox: the script blocker below will prevent us from executing taint notifications!
// Foxhound: the script blocker below will prevent us from executing taint notifications!
// So add our own callback to check the taint, even if value is not changing
CheckTaintSinkSetAttr(aNamespaceID, aName, aValue);

Expand Down Expand Up @@ -2987,7 +2987,7 @@ bool Element::GetAttr(const nsAtom* aName, nsAString& aResult, bool doTainting)
return false;
}
val->ToString(aResult);
// Taintfox: getAttribute source
// Foxhound: getAttribute source
if (doTainting && aResult.Length() > 0) {
SetTaintSourceGetAttr(aName, aResult);
}
Expand All @@ -3002,7 +3002,7 @@ bool Element::GetAttr(int32_t aNameSpaceID, const nsAtom* aName,
return false;
}
val->ToString(aResult);
// Taintfox: getAttribute source
// Foxhound: getAttribute source
if (doTainting && aResult.Length() > 0) {
SetTaintSourceGetAttr(aName, aResult);
}
Expand Down Expand Up @@ -4031,7 +4031,7 @@ void Element::SetInnerHTML(const nsAString& aInnerHTML,
nsIPrincipal* aSubjectPrincipal,
ErrorResult& aError) {

// TaintFox: innerHTML sink - don't set for template elements
// Foxhound: innerHTML sink - don't set for template elements
if (!IsTemplateElement()) {
ReportTaintSink(aInnerHTML, "innerHTML", this);
}
Expand All @@ -4058,7 +4058,7 @@ void Element::SetOuterHTML(const nsAString& aOuterHTML, ErrorResult& aError) {
return;
}

// TaintFox: outerHTML sink.
// Foxhound: outerHTML sink.
ReportTaintSink(aOuterHTML, "outerHTML", this);

if (OwnerDoc()->IsHTMLDocument()) {
Expand Down Expand Up @@ -4108,7 +4108,7 @@ enum nsAdjacentPosition { eBeforeBegin, eAfterBegin, eBeforeEnd, eAfterEnd };

void Element::InsertAdjacentHTML(const nsAString& aPosition,
const nsAString& aText, ErrorResult& aError) {
// TaintFox: insertAdjacentHTML sink
// Foxhound: insertAdjacentHTML sink
ReportTaintSink(aText, "insertAdjacentHTML", this);

nsAdjacentPosition position;
Expand Down Expand Up @@ -4239,7 +4239,7 @@ void Element::InsertAdjacentText(const nsAString& aWhere,
const nsAString& aData, ErrorResult& aError) {
RefPtr<nsTextNode> textNode = OwnerDoc()->CreateTextNode(aData);

// TaintFox: insertAdjacentHTML sink
// Foxhound: insertAdjacentHTML sink
ReportTaintSink(aData, "insertAdjacentText", this);

InsertAdjacent(aWhere, textNode, aError);
Expand Down
8 changes: 4 additions & 4 deletions dom/base/Element.h
Original file line number Diff line number Diff line change
Expand Up @@ -1165,7 +1165,7 @@ class Element : public FragmentOrElement {
return false; // DOMString comes pre-emptied.
}
val->ToString(aResult);
// Taintfox element.getAttr source
// Foxhound: element.getAttr source
if (doTainting && aResult.Length() > 0) {
SetTaintSourceGetAttr(aName, aResult);
}
Expand All @@ -1180,7 +1180,7 @@ class Element : public FragmentOrElement {
return false; // DOMString comes pre-emptied.
}
val->ToString(aResult);
// Taintfox element.getAttr source
// Foxhound: element.getAttr source
if (doTainting && aResult.Length() > 0) {
SetTaintSourceGetAttr(aNameSpaceID, aName, aResult);
}
Expand All @@ -1196,7 +1196,7 @@ class Element : public FragmentOrElement {
const nsAttrValue* val = mAttrs.GetAttr(aName);
if (val) {
val->ToString(aResult);
// Taintfox element.getAttr source
// Foxhound element.getAttr source
if (doTainting && aResult.Length() > 0) {
SetTaintSourceGetAttr(aName, aResult);
}
Expand Down Expand Up @@ -1990,7 +1990,7 @@ class Element : public FragmentOrElement {
void SetTaintSourceGetAttr(int32_t aNameSpaceID, const nsAtom* aName,
DOMString& aResult) const;
/**
* Taintfox: this method can be overriden by child classes to mark
* Foxhound: this method can be overriden by child classes to mark
* certain attributes as taint sources.
*/
virtual void SetTaintSourceGetAttr(const nsAString& aName, DOMString& aResult) const;
Expand Down
2 changes: 1 addition & 1 deletion dom/base/EventSource.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -636,7 +636,7 @@ void EventSourceImpl::Init(nsIPrincipal* aPrincipal, const nsAString& aURL,
MOZ_ASSERT(aPrincipal);
MOZ_ASSERT(ReadyState() == CONNECTING);
mPrincipal = aPrincipal;
// Taintfox: EventSource sink
// Foxhound: EventSource sink
ReportTaintSink(aURL, "EventSource");
aRv = ParseURL(aURL);
if (NS_WARN_IF(aRv.Failed())) {
Expand Down
32 changes: 16 additions & 16 deletions dom/base/Location.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -150,7 +150,7 @@ void Location::GetHash(nsAString& aHash, nsIPrincipal& aSubjectPrincipal,
AppendUTF8toUTF16(ref, aHash);
}

// TaintFox: location.hash source.
// Foxhound: location.hash source.
MarkTaintSource(aHash, "location.hash");

mCachedHash = aHash;
Expand Down Expand Up @@ -179,7 +179,7 @@ void Location::SetHash(const nsAString& aHash, nsIPrincipal& aSubjectPrincipal,
return;
}

// TaintFox: location.hash sink.
// Foxhound: location.hash sink.
// TODO(samuel) why?
ReportTaintSink(aHash, "location.hash");

Expand Down Expand Up @@ -208,7 +208,7 @@ void Location::GetHost(nsAString& aHost, nsIPrincipal& aSubjectPrincipal,
if (NS_SUCCEEDED(result)) {
AppendUTF8toUTF16(hostport, aHost);

// TaintFox: location.host source.
// Foxhound: location.host source.
MarkTaintSource(aHost, "location.host");
}
}
Expand All @@ -233,7 +233,7 @@ void Location::SetHost(const nsAString& aHost, nsIPrincipal& aSubjectPrincipal,
return;
}

// TaintFox: location.host sink.
// Foxhound: location.host sink.
ReportTaintSink(aHost, "location.host");

SetURI(uri, aSubjectPrincipal, aRv);
Expand All @@ -253,7 +253,7 @@ void Location::GetHostname(nsAString& aHostname,
if (uri) {
nsContentUtils::GetHostOrIPv6WithBrackets(uri, aHostname);

// TaintFox: location.hostname source.
// Foxhound: location.hostname source.
MarkTaintSource(aHostname, "location.hostname");
}
}
Expand Down Expand Up @@ -297,7 +297,7 @@ nsresult Location::GetHref(nsAString& aHref) {

AppendUTF8toUTF16(uriString, aHref);

// TaintFox: location.href source.
// Foxhound: location.href source.
MarkTaintSource(aHref, "location.href");

return NS_OK;
Expand Down Expand Up @@ -326,7 +326,7 @@ void Location::GetOrigin(nsAString& aOrigin, nsIPrincipal& aSubjectPrincipal,

aOrigin = origin;

// TaintFox: location.origin source.
// Foxhound: location.origin source.
MarkTaintSource(aOrigin, "location.origin");
}

Expand Down Expand Up @@ -354,7 +354,7 @@ void Location::GetPathname(nsAString& aPathname,

AppendUTF8toUTF16(file, aPathname);

// TaintFox: location.pathname source.
// Foxhound: location.pathname source.
MarkTaintSource(aPathname, "location.pathname");
}

Expand All @@ -378,7 +378,7 @@ void Location::SetPathname(const nsAString& aPathname,
return;
}

// Taintfox: location.pathname sink
// Foxhound: location.pathname sink
ReportTaintSink(aPathname, "location.pathname");

SetURI(uri, aSubjectPrincipal, aRv);
Expand Down Expand Up @@ -407,7 +407,7 @@ void Location::GetPort(nsAString& aPort, nsIPrincipal& aSubjectPrincipal,
nsAutoString portStr;
portStr.AppendInt(port);
aPort.Append(portStr);
// TaintFox: location.port source.
// Foxhound: location.port source.
MarkTaintSource(aPort, "location.port");
}
}
Expand Down Expand Up @@ -443,7 +443,7 @@ void Location::SetPort(const nsAString& aPort, nsIPrincipal& aSubjectPrincipal,
return;
}

// TaintFox: location.port sink.
// Foxhound: location.port sink.
ReportTaintSink(aPort, "location.port");

SetURI(uri, aSubjectPrincipal, aRv);
Expand Down Expand Up @@ -474,7 +474,7 @@ void Location::GetProtocol(nsAString& aProtocol,
CopyASCIItoUTF16(protocol, aProtocol);
aProtocol.Append(char16_t(':'));

// TaintFox: location.protocol source.
// Foxhound: location.protocol source.
MarkTaintSource(aProtocol, "location.protocol");
}

Expand All @@ -491,7 +491,7 @@ void Location::SetProtocol(const nsAString& aProtocol,
return;
}

// TaintFox: location.protocol sink.
// Foxhound: location.protocol sink.
ReportTaintSink(aProtocol, "location.protocol");

nsAString::const_iterator start, end;
Expand Down Expand Up @@ -559,7 +559,7 @@ void Location::GetSearch(nsAString& aSearch, nsIPrincipal& aSubjectPrincipal,
aSearch.Assign(char16_t('?'));
AppendUTF8toUTF16(search, aSearch);

// TaintFox: location.search source.
// Foxhound: location.search source.
MarkTaintSource(aSearch, "location.search");
}
}
Expand All @@ -585,7 +585,7 @@ void Location::SetSearch(const nsAString& aSearch,
return;
}

// TaintFox: location.search sink.
// Foxhound: location.search sink.
ReportTaintSink(aSearch, "location.search");

SetURI(uri, aSubjectPrincipal, aRv);
Expand Down Expand Up @@ -641,7 +641,7 @@ void Location::Assign(const nsAString& aUrl, nsIPrincipal& aSubjectPrincipal,
return;
}

// Taintfox: location.assign sink
// Foxhound: location.assign sink
ReportTaintSink(aUrl, "location.assign");

DoSetHref(aUrl, aSubjectPrincipal, false, aRv);
Expand Down
4 changes: 2 additions & 2 deletions dom/base/LocationBase.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -192,7 +192,7 @@ void LocationBase::SetURI(nsIURI* aURI, nsIPrincipal& aSubjectPrincipal,
void LocationBase::SetHref(const nsAString& aHref,
nsIPrincipal& aSubjectPrincipal, ErrorResult& aRv) {

// Taintfox: location.href sink
// Foxhound: location.href sink
ReportTaintSink(aHref, "location.href");

DoSetHref(aHref, aSubjectPrincipal, false, aRv);
Expand Down Expand Up @@ -259,7 +259,7 @@ void LocationBase::SetHrefWithBase(const nsAString& aHref, nsIURI* aBase,
void LocationBase::Replace(const nsAString& aUrl,
nsIPrincipal& aSubjectPrincipal, ErrorResult& aRv) {

// Taintfox: location.assign sink
// Foxhound: location.assign sink
ReportTaintSink(aUrl, "location.replace");

DoSetHref(aUrl, aSubjectPrincipal, true, aRv);
Expand Down
2 changes: 1 addition & 1 deletion dom/base/nsAttrValue.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -2118,7 +2118,7 @@ already_AddRefed<mozilla::StringBuffer> nsAttrValue::GetStringBuffer(
buf && (buf->StorageSize() / sizeof(char16_t) - 1) == len) {
// We can only reuse the buffer if it's exactly sized, since we rely on
// StorageSize() to get the string length in ToString().
// TaintFox: propagate taint.
// Foxhound: propagate taint.
if (aValue.isTainted()) {
buf->AssignTaint(aValue.Taint());
}
Expand Down
Loading
Loading