On Wed, Jun 25, 2014 at 8:49 AM, Nicolas B. Pierron <[email protected]> wrote: > So far, we received 3 different proposals for adding coarse/fine grain > implementations of taint analysis in the JavaScript engine. (I cannot name > all of them publicly yet)
Are we talking about taint analysis as an auditing tool, or as a web-accessible feature? The latter has generally been considered too costly to be worth using. I've been lightly mentoring a research project with Stanford that does information flow control at the level of the global, and leverages our security wrappers to prevent exfiltration of sensitive data. It's a very interesting a approach: http://www.scs.stanford.edu/~deian/cowl.pdf > Accepting any of the taint analysis proposals has a price, either this is a > maintenance cost, as these implementations are entangled in many parts of > the JavaScript engine, or/and these implementation suffer from a overhead > even when they are disabled. Yeah, I'm really not wild about this. Adding information flow analysis to the engine is going to be _really_ invasive. And we can't just keep the analysis confined to the interpreter / JIT, because then information will leak all over the place via JSAPI/DOM. What's our proposed SLA? Is it a security bug if we get part of this wrong? What's our commitment to fixing it? bholley _______________________________________________ dev-tech-js-engine-internals mailing list [email protected] https://lists.mozilla.org/listinfo/dev-tech-js-engine-internals
