This commit fixes a critical DOM Clobbering vulnerability that allowed a target application to disable the IAST analyzer by overwriting its global callback functions.

The following changes have been implemented:

1.  **Randomized Callback Names:** The Go backend now generates unique, session-specific names for the `sink_event`, `execution_proof`, and `shim_error` callbacks by appending a UUID. This prevents attackers from predicting the function names.

2.  **Dynamic Probe Generation:** XSS probes are now generated dynamically to use the session-specific `execution_proof` callback name, ensuring payloads trigger the correct, non-clobberable function.

3.  **Defense-in-Depth JS Closure:** The JavaScript shim has been hardened to immediately capture the exposed callback functions into a local closure upon initialization. All internal reporting now uses these captured references, making the shim immune to DOM Clobbering that occurs after it has loaded.

4.  **Updated Tests:** All relevant unit tests have been updated to accommodate the dynamic nature of the callback names, ensuring the test suite passes and validates the new behavior.

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>

This commit fixes a critical DOM Clobbering vulnerability that allowed a target application to disable the IAST analyzer by overwriting its global callback functions.

The following changes have been implemented:

1.  **Randomized Callback Names:** The Go backend now generates unique, session-specific names for the `sink_event`, `execution_proof`, and `shim_error` callbacks by appending a UUID. This prevents attackers from predicting the function names.

2.  **Dynamic Probe Generation:** XSS probes are now generated dynamically to use the session-specific `execution_proof` callback name, ensuring payloads trigger the correct, non-clobberable function.

3.  **Defense-in-Depth JS Closure:** The JavaScript shim has been hardened to immediately capture the exposed callback functions into a local closure upon initialization. All internal reporting now uses these captured references, making the shim immune to DOM Clobbering that occurs after it has loaded.

4.  **Updated Tests:** All relevant unit tests have been updated to accommodate the dynamic nature of the callback names, ensuring the test suite passes and validates the new behavior.

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>

This commit fixes a critical DOM Clobbering vulnerability that allowed a target application to disable the IAST analyzer by overwriting its global callback functions.

The following changes have been implemented:

1.  **Randomized Callback Names:** The Go backend now generates unique, session-specific names for the `sink_event`, `execution_proof`, and `shim_error` callbacks by appending a UUID. This prevents attackers from predicting the function names.

2.  **Dynamic Probe Generation:** XSS probes are now generated dynamically to use the session-specific `execution_proof` callback name, ensuring payloads trigger the correct, non-clobberable function.

3.  **Defense-in-Depth JS Closure:** The JavaScript shim has been hardened to immediately capture the exposed callback functions into a local closure upon initialization. All internal reporting now uses these captured references, making the shim immune to DOM Clobbering that occurs after it has loaded.

4.  **Updated Tests:** All relevant unit tests have been updated to accommodate the dynamic nature of the callback names, ensuring the test suite passes and validates the new behavior.

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>