Rasmus Wriedt Larsen 61e60de969 JS: Model readline as a stdin threat-model source ...

Technically not always true, but my assumption is that +90% of the time
that's what it will be used for, so while we could be more precise by
adding a taint-step from the `input` part of the construction, I'm not
sure it's worth it in this case.

Furthermore, doing so would break with the current way we model
threat-model sources, and how sources are generally modeled in JS... so
for a very pretty setup it would require changing all the other `file`
threat-model sources to start at the constructors such as
`fs.createReadStream()` and have taint-propagation steps towards the
actual use (like we do in Python)...

I couldn't see an easy path forwards for doing this while keeping the
Concepts integration, so I opted for the simpler solution here.

2024-10-31 14:29:30 +01:00

..

default

JS: Remove 'response' from default threat-models

2024-10-25 14:52:49 +02:00

sources

JS: Model readline as a stdin threat-model source

2024-10-31 14:29:30 +01:00