You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
After consulting with a Security Team, we identified some approaches how this should be done.
There are two phases of testing identified:
Trying to make changes to the endowments which should not be possible at all (hardening with harden() SES function).
Searching all objects for globalThis references which exposure to the snap should be prevented.
Several testing approaches are implemented to ensure the security.
Further manual in-detail security audit of the JavaScript intrinsic objects might be required to fully confirm security of it which possibly can be addressed in the two remaining tickets in this epic.
This ticket should focus on finding a way how to harden specific endowments such as endowments that are constructor functions.
One of the suggestion was using Proxies, so that should be one of the starting points for this research.
This ticket will unblock and refine the following tickets:
#1018
#1017
In general, constructor functions are target for the hardening and are presented in the table below:
The text was updated successfully, but these errors were encountered: