Data Tainting

Netscape 3 had a security model where data could be marked tainted, and one function survived returning false about it for the next twenty years.

In 2026: Dead. Tainting let a script mark values as sensitive so they could not leak across origins, an opt-in experiment in Navigator 3 that Navigator 4 abandoned. The taint and untaint functions vanished, but navigator.taintEnabled lingered in browsers for two decades, hardwired to return false, purely so ancient scripts would not crash. The demo calls that faithful little liar.

Where it came from: Netscape data tainting, Navigator 3, JavaScript 1.1, 1996. Abandoned in Navigator 4; the taintEnabled stub outlived it by two decades. MDN ↗

<script language="JavaScript">
// Netscape 3's data-tainting security check. It still answers, always the same.
if (navigator.taintEnabled) {
  document.write("<p>navigator.taintEnabled() returns: " +
                 navigator.taintEnabled() + "</p>");
  document.write("<p>It has returned false, unchanged, for about twenty years, " +
                 "so old scripts that call it do not throw.</p>");
} else {
  document.write("<p>Even the stub is gone now.</p>");
}
</script>