Taint Info

Taint Representation

TheHulk associates taint information with JavaScript values in two distinct ways. For primitive types such as strings, numbers, bigints, and booleans, we encapsulate the concrete value and its taint information within a WrappedValue object. For compound data types like arrays and objects, we add the taint information as a specific field named __TAINT__.

We need to taint values beyond primitives for two reasons: 1/ tainted String values can reside within objects and later be converted back to String. 2/ keep track of the attacker controlled object (e.g. DOM Nodes), and taint the loaded data.

For example:

let taintedString = J$$.wrapTaint('exampleJ$1exampleJ$2');
let taintedStringRegIter = taintedString.matchAll(/J\$\d/g); 
// taintedStringRegIter is of type RegExpStringIterator
let taintedMatches = Array.from(taintedStringRegIter);
// taintedMatches
// (2) [Array(1), Array(1)]
// 0: ['J$1', index: 7, input: 'exampleJ$1exampleJ$2', groups: undefined]
// 1: ['J$2', index: 17, input: 'exampleJ$1exampleJ$2', groups: undefined]
// length: 2

The output of taintedString.matchAll() is a RegExpStringIterator. After using Array.from, the resulting taintedMatches array should propagate the taint information to its first child elements (i.e., 'J$1' and 'J$2'). This ensures that the taint information is consistently propagated through different data types and operations.