It’s pretty well known that overridden objects in Javascript can cause security issues, or just development bugs. I’m concerned about the security here.
Suppose I have a sensitive JSON result that will be saved in a variable… and that variable has either been previously defined with a _prototypes, getter/setter. Further assume that instead of just being a memory allocation, the result was sent to a function that sent it to a “bad guy”. Now my sensitive data is outside my application.
My intent is to find a way to “clean” Javascript, cookies, SOP, and memory back to it’s original state prior to be starting a session within a given browser.
-
I know I mentioned a few tricky components here, but is any cleaning or validation possible?
-
Is it possible to reset the in-memory status to a known good state?
In distributed computing, you must always assume that the client is in the hands of the enemy (in this case, that’s the browser). And that they will do to it whatever they want. If your application’s security depends on the correct execution of some code on the client’s side, then it’s not going to be secure.
tl;dr: No.