I'm working on a project where I want to achieve taint tracking in Chromium. In essence, I want to be able to identify things coming from the DOM, what might happen to them (concat, substring, etc) and be able to identify variables derived from them. My question in a nutshell is: how and where are calls to the DOM implemented? I gather that v8 is provided a context from the rendering engine and then works on that - couldn't find the corresponding code though.
On Fri, May 18, 2012 at 1:17 PM, <sqrts...@googlemail.com> wrote:
> Hi guys,
> I'm working on a project where I want to achieve taint tracking in
> Chromium. In essence, I want to be able to identify things coming from the
> DOM, what might happen to them (concat, substring, etc) and be able to
> identify variables derived from them. My question in a nutshell is: how and
> where are calls to the DOM implemented? I gather that v8 is provided a
> context from the rendering engine and then works on that - couldn't find
> the corresponding code though.
> On Fri, May 18, 2012 at 1:17 PM, <sqrts...@googlemail.com> wrote:
>> Hi guys,
>> I'm working on a project where I want to achieve taint tracking in >> Chromium. In essence, I want to be able to identify things coming from the >> DOM, what might happen to them (concat, substring, etc) and be able to >> identify variables derived from them. My question in a nutshell is: how and >> where are calls to the DOM implemented? I gather that v8 is provided a >> context from the rendering engine and then works on that - couldn't find >> the corresponding code though.
Did you find the answer of this? Similar to what you are trying to do, I would like to intercept all access to DOM elements of the page. I guess that should be possible in v8, but don't know how.
>> On Fri, May 18, 2012 at 1:17 PM, <sqrt...@googlemail.com <javascript:>>wrote:
>>> Hi guys,
>>> I'm working on a project where I want to achieve taint tracking in >>> Chromium. In essence, I want to be able to identify things coming from the >>> DOM, what might happen to them (concat, substring, etc) and be able to >>> identify variables derived from them. My question in a nutshell is: how and >>> where are calls to the DOM implemented? I gather that v8 is provided a >>> context from the rendering engine and then works on that - couldn't find >>> the corresponding code though.
