Re: [Bug-librejs] Non triviality criterion

[Cathal Garvey]

How does LibreJS deal with heavily obfuscated JavaScript, where identifiers 
like "eval" and "window" can be accessed and indexed using only characters like 
[]{}+ etc.?

Probably a regex rule that simply finds runs of these characters would catch 
most, but the root problem of malicious obfuscation is probably only solvable 
with access to the compiled bytecode, or by being able to hook attribute access.

Perhaps it's possible, before pageload, to shadow these attributes and 
intercept them if untrusted code accesses them? Maybe librejs already does 
this.. Or maybe you can't shadow `window` and `eval`..

On 1 October 2017 17:03:13 GMT+01:00, Nathan Nichols <address@hidden> wrote:
>>We consider modification of the document non-trivial. There shouldn't
>be
>>much that javascript could do that we would consider trivial, for
>>anything else a free software license would be required.
>
>I see.
>
>Can you give me a general idea about the preferred way for me to go
>about
>implementing these rules?
>
>>Using regexps to check for the existence of non-trivial actions (such
>as
>>using ajax or calling eval) can filter many scripts quickly, so it is
>a
>>good way to speed the test up. But it is not sufficient.
>
>If you believe that this system I came up with can be used as a first
>pass
>to filter out scripts quickly, can you help me understand what would be
>needed in addition to what is already guaranteed by this first pass?

-- 
Sent from my Android device with K-9 Mail. Please excuse my brevity.