Taint Flow Design 2.0

Currently, we see a tainted string as a sequence of sequence of operations on different parts of a tainted string. This is effectively a very simplified view, as a tainted string stems from a directed graph (potentially with cycles?) of operation sequences. This gets more pronounced with primitive tainting, so we should maybe start this page to collect actual issues and how this could look like in the future.

Currently, we have something like this

flowchart TD
    source1[location.hash]
    source2[location.href]
    static1[static string]
    r1l[partially tainted string]
    static2[static string]
    r2r[partially tainted string]
    r3lr[partially tainted string]
    sink[innerHTML]
    source1 --> r1l;
    static1 --> r1l;
    static2 --> r2r;
    source2 --> r2r;
    r1l --> r3lr;
    r2r --> r3lr;
    r3lr --> sink;

Loading

Which we would basically display as a finding looking as follows: