edbrowse-dev - development list for edbrowse
 help / color / mirror / Atom feed
* [edbrowse-dev] It can be done, but is it worth it?
@ 2021-03-29  0:43 Karl Dahlke
  2021-03-29 16:53 ` Adam Thompson
  0 siblings, 1 reply; 4+ messages in thread
From: Karl Dahlke @ 2021-03-29  0:43 UTC (permalink / raw)
  To: edbrowse-dev

[-- Attachment #1: Type: text/plain, Size: 1211 bytes --]

This with regard to sharing classes and methods in the master window.

As mentioned, we put a class or method or constant there, we have to know it can't be tampered with.
Do this.

Object.defineProperty(mw$, "blah",{enumerable:false,writable:false,configurable:false});

Not just what we put in the master window, but the methods we put in the prototypes in the classes in the master window,
and the prototype objects themselves. All of it.

But what stops them from adding something nefarious?
But we can detect it.
After every browse, and after every js function, in jSideEffects(),
I could call a master window tamper check method
that would get all the keys in the master window, and all the keys in the prototypes of our classes,
and count them, and make sure no new ones were added.
See the latest commit which uses GetOwnPropertyNames() to do this.
So we could detect tampering, and if discovered, turn off javascript for the duration of the edbrowse program.
It's ugly to implement, the solution is a bit drastic, but it would be secure,
and would guard against something that almost certainly would never happen.

That's the thought for the day.

Karl Dahlke

^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, other threads:[~2021-03-31 17:32 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-03-29  0:43 [edbrowse-dev] It can be done, but is it worth it? Karl Dahlke
2021-03-29 16:53 ` Adam Thompson
2021-03-31  2:41   ` Karl Dahlke
2021-03-31 17:31     ` Adam Thompson

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).