Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Backdooring JavaScript using minifier bugs

zyan.scripts.mit.edu

Post reply on HN
Print view View original

1–10 of 37 posts

Re: Backdooring JavaScript using minifier bugs

#4

Post by nathankleyn »

yoz-y wrote: post #3

I wonder. Should one ever use minified javascript code on a server? Assuming that you are using it on your own server and not distributing the code to clients. Is there any benefit to it?

Almost certainly not, if only because it's another layer of indirection when debugging and for this use you're not limited by distribution size.

There is a potential benefit if the minifier can apply some performance optimisations, but one would hope V8 et al are already doing most of these and more.

Even for client-side applications, HTTP2 + Web Assembly will eradicate concatenating and minifying JS files soon.

Re: Backdooring JavaScript using minifier bugs

#5

Post by jand »

Nice to read text on a clever find.

Could somebody please confirm or invalidate my understanding, that this backdoor is just exploitable in addition with other (severe) issues?

An attacker would have to have the ability to tailor/manipulate JS scripts which should be under control of the victim?

Or am i mistaken?

Re: Backdooring JavaScript using minifier bugs

#6

Post by bcrypt »

nathankleyn wrote: post #4
yoz-y wrote: post #3

I wonder. Should one ever use minified javascript code on a server? Assuming that you are using it on your own server and not distributing the code to clients. Is there any benefit to it?

Almost certainly not, if only because it's another layer of indirection when debugging and for this use you're not limited by distribution size. There is a potential benefit if the minifier can apply some performance optimisations, but one would hope V8 et al are already doing most of these and more. Even for client-side applications, HTTP2 + Web Assembly will eradicate concatenating and minifying JS files soon.

OP here. Agree there probably isn't much benefit to minifying server-side code. However, I wouldn't be surprised if things like Closure Compiler were useful server-side.

Not convinced that HTTP2 will eradicate minifiers; it makes bundling files less useful, but minifying still gets rid of bytes. Then again, I'm not a web performance expert. :)

Re: Backdooring JavaScript using minifier bugs

#7

Post by gliptic »

nathankleyn wrote: post #4
yoz-y wrote: post #3

I wonder. Should one ever use minified javascript code on a server? Assuming that you are using it on your own server and not distributing the code to clients. Is there any benefit to it?

Almost certainly not, if only because it's another layer of indirection when debugging and for this use you're not limited by distribution size. There is a potential benefit if the minifier can apply some performance optimisations, but one would hope V8 et al are already doing most of these and more. Even for client-side applications, HTTP2 + Web Assembly will eradicate concatenating and minifying JS files soon.

Why would HTTP2 eradicate the minifier? It seems completely orthogonal to minification.

Re: Backdooring JavaScript using minifier bugs

#8

Post by bcrypt »

jand wrote: post #5

Nice to read text on a clever find. Could somebody please confirm or invalidate my understanding, that this backdoor is just exploitable in addition with other (severe) issues? An attacker would have to have the ability to tailor/manipulate JS scripts which should be under control of the victim? Or am i mistaken?

That's correct. I did not discover vulnerabilities in existing libraries or add backdoors to any of them. :)

The attack scenario described in the post is (1) attacker writes some plausible-looking patches to an existing library like jQuery, (2) attacker convinces library maintainer to merge the patches, (3) someone builds the library with a buggy minifier, which creates the actual backdoor.

Re: Backdooring JavaScript using minifier bugs

#9

Post by nathankleyn »

bcrypt wrote: post #6
nathankleyn wrote: post #4

Earlier quoted context omitted.

Almost certainly not, if only because it's another layer of indirection when debugging and for this use you're not limited by distribution size. There is a potential benefit if the minifier can apply some performance optimisations, but one would hope V8 et al are already doing most of these and more. Even for client-side applications, HTTP2 + Web Assembly will eradicate concatenating and minifying JS files soon.

OP here. Agree there probably isn't much benefit to minifying server-side code. However, I wouldn't be surprised if things like Closure Compiler were useful server-side. Not convinced that HTTP2 will eradicate minifiers; it makes bundling files less useful, but minifying still gets rid of bytes. Then again, I'm not a web performance expert. :)

Sorry, that's a mistake - I meant to write "HTTP2 + Web Assembly" (which will take the place of file concatenation and minification).

Re: Backdooring JavaScript using minifier bugs

#10

Post by nathankleyn »

gliptic wrote: post #7
nathankleyn wrote: post #4

Earlier quoted context omitted.

Almost certainly not, if only because it's another layer of indirection when debugging and for this use you're not limited by distribution size. There is a potential benefit if the minifier can apply some performance optimisations, but one would hope V8 et al are already doing most of these and more. Even for client-side applications, HTTP2 + Web Assembly will eradicate concatenating and minifying JS files soon.

Why would HTTP2 eradicate the minifier? It seems completely orthogonal to minification.

Edited, that's a mistake - I meant to write "HTTP2 + Web Assembly" (which will take the place of file concatenation and minification).
Post reply on HN