From mboxrd@z Thu Jan 1 00:00:00 1970 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on inbox.vuxu.org X-Spam-Level: ** X-Spam-Status: No, score=2.1 required=5.0 tests=DKIM_INVALID,DKIM_SIGNED, FREEMAIL_FROM,HDRS_MISSP autolearn=no autolearn_force=no version=3.4.4 Received: (qmail 21913 invoked from network); 29 Mar 2021 00:44:08 -0000 Received: from hurricane.the-brannons.com (2602:ff06:725:1:20::25) by inbox.vuxu.org with ESMTPUTF8; 29 Mar 2021 00:44:08 -0000 Received: from localhost.localdomain (localhost [127.0.0.1]) by hurricane.the-brannons.com (OpenSMTPD) with ESMTP id 979a5168 for ; Sun, 28 Mar 2021 17:44:02 -0700 (PDT) Received: from resdmta-ch2-02v.sys.comcast.net (resdmta-ch2-02v.sys.comcast.net [2001:558:fe21:29:69:252:207:82]) by hurricane.the-brannons.com (OpenSMTPD) with ESMTPS id b1b233ed (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256:NO) for ; Sun, 28 Mar 2021 17:43:27 -0700 (PDT) Received: from resqmta-ch2-11v.sys.comcast.net ([69.252.207.43]) by resdmta-ch2-02v.sys.comcast.net with ESMTP id QexPloHgdLnUaQg04lpzJB; Mon, 29 Mar 2021 00:43:24 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcast.net; s=20190202a; t=1616978604; bh=m1HPPAwoXDZN56oFc0BXeI6paM1k4uMDJwFe3KFaZ/4=; h=Received:Received:Received:To:From:Reply-to:Subject:Date: Message-ID:Mime-Version:Content-Type; b=cVD7U8jwtumRUF7hjWJ+WDb4ptf0Xd0sr87tuWUskk99ncD5Bw/qvJOiF51AqD67G +NU9txolMIfzIE3Eb7gJ2fupiOSt7vvBV/pco+5UoRU9H9NvgJxO9/3i1qwM4btbHs AKQq7Wdk4TGff4mOyO41Xyi9gzhMRUV2L0JhhurivrkAx+2rn29Xhe1kaFh2GjOEO2 FmBxbGOdSjPUQ7EC8T9kRpjJpMT9rC77WVqBlbqZfOYL/XQeYirYciCOxAUV5wWXtS GNiPpXgR4kGwJgFmcHGxFE3MFaED6TP2Rd35dVN9D0+10YQrVaMDV/com10IcUadh4 Wj75DMmwOuaCA== Received: from resomta-ch2-06v.sys.comcast.net ([69.252.207.102]) by resqmta-ch2-11v.sys.comcast.net with ESMTP id QflylXZ4ujtOrQg03lIbBY; Mon, 29 Mar 2021 00:43:23 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcast.net; s=20190202a; t=1616978603; bh=m1HPPAwoXDZN56oFc0BXeI6paM1k4uMDJwFe3KFaZ/4=; h=Received:Received:To:From:Reply-to:Subject:Date:Message-ID: Mime-Version:Content-Type; b=PB6ADs5zSR/JvUttpqAKgZp/p/UqDOMUHAQTWoP17S13TKJP/7kPIw0Qz8CnbwlEX M1989gLGsCDTUkw/usr6plujXp07xlPjDI41LCcB8Jg9xTmsoir4ywlhnu395cnUWE NKQ5gbDy+6BystvSbpAl0qy7a5ErJBUNYM3tIGqqP+7LlpblGQryxlE/DLM6ieoW6j YWQRbnJmfd4s+mPPXkzFHiiL2d/Q8Z/rw5hMyaYTLS/RmlYHafdS5+LO7lKJ84tAW5 C/0tAx09isQn1X3CdKn5XGSNy88sVxE+bf59QgADasYOuLi1Ka3sWG+H0r4Y9CicK4 192mAaOGvmTZw== Received: from unknown ([IPv6:2601:408:c300:a3d0::8f8f]) by resomta-ch2-06v.sys.comcast.net with ESMTPSA id Qg02lQtIxRxAFQg02lYstj; Mon, 29 Mar 2021 00:43:23 +0000 X-Xfinity-VMeta: sc=0.00;st=legit To:edbrowse-dev@edbrowse.org From: Karl Dahlke Reply-to: Karl Dahlke User-Agent: edbrowse/3.8.0 Subject: [edbrowse-dev] It can be done, but is it worth it? Date: Sun, 28 Mar 2021 20:43:22 -0400 Message-ID: <20210228204322.eklhad@comcast.net> X-BeenThere: edbrowse-dev@edbrowse.org List-Id: Edbrowse Development List Mime-Version: 1.0 Content-Type: multipart/mixed; boundary=nextpart-eb-996194 Content-Transfer-Encoding: 7bit This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. --nextpart-eb-996194 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable This with regard to sharing classes and methods in the master window. As mentioned, we put a class or method or constant there, we have to = know it can't be tampered with. Do this. Object.defineProperty(mw$, = "blah",{enumerable:false,writable:false,configurable:false}); Not just what we put in the master window, but the methods we put in = the prototypes in the classes in the master window, and the prototype objects themselves. All of it. There. But what stops them from adding something nefarious? Nothing. But we can detect it. After every browse, and after every js function, in jSideEffects(), I could call a master window tamper check method that would get all the keys in the master window, and all the keys in = the prototypes of our classes, and count them, and make sure no new ones were added. See the latest commit which uses GetOwnPropertyNames() to do this. So we could detect tampering, and if discovered, turn off javascript = for the duration of the edbrowse program. It's ugly to implement, the solution is a bit drastic, but it would be = secure, and would guard against something that almost certainly would never = happen. That's the thought for the day. Karl Dahlke --nextpart-eb-996194--