Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Angular 1.x Banned from Firefox Addons

github.com

Post reply on HN
Print view View original

31–40 of 222 posts

Re: Angular 1.x Banned from Firefox Addons

#31

Post by Gigablah »

nathancahill wrote: post #13
phs2501 wrote: post #6

So someone found some sort of vulnerability in Angular 1, told Mozilla about it, but told them not to tell the Angular team? What is going on here?

It's possible that the vulnerability only effects Angular running in Firefox addons, and not the general web. Mozilla takes an aggressive stance on what they allow in vetted browser extensions, as they should. JS in addons runs in a different, more privileged environment than normal web pages, and isn't restricted by things like same-origin (although this is improving with Firefox's new extension APIs). Any project t…

In other words, the vulnerability is with Firefox instead of Angular?

Re: Angular 1.x Banned from Firefox Addons

#32

Post by xxkylexx »

martey wrote: post #27
xxkylexx wrote: post #12

Earlier quoted context omitted.

No, the engineer is asking for more information so that he can determine if the application is truly affected by some unpublished Angular vulnerability or if Mozilla is just being too aggressive with their ban hammer because someone said "Angular 1.x was no longer being officially supported", which is false.

I think encoderer was referring to https://github.com/mozilla/addons-linter/issues/1000#issueco... , where the engineer asks, "Is there any possible way for us to get around this ban?"

Which is referring to the possibility that the application may not be using some feature that is affected by this supposed top secret vulnerability.

Re: Angular 1.x Banned from Firefox Addons

#33

Post by moron4hire »

yc-kraln wrote: post #16

"we were not able to report them to angular as the security researcher who found them asked us to not share them." Nice.

I read that and said a literal WTF. How is it at all acceptable to honor such a request? What possible good reason could there be?

Unless the discloser was the US Government and the request was actually a court order. But this seems ludicrous. If they require secrecy around the exploit, they wouldn't have disclosed it to Mozilla at all.

Re: Angular 1.x Banned from Firefox Addons

#34

Post by AgentME »

BHSPitMonkey wrote: post #17

If there is some permutation of JavaScript statements (library or otherwise) that displays a security vulnerability for the user, isn't that the browser's fault and not the application's? And isn't library detection just a hacky substitute for an actual fix of said fault?

It's not the browser's fault if an extension has a vulnerability which gives away the capabilities the extension was given. It would be the browser's fault if the extension had a vulnerability which somehow managed to give away more permissions than the extension was given in the first place.

In this specific case, Angular runs eval-like functions on HTML in the DOM. The DOM can be controlled by the webpage. If Angular is running in a higher-privilege extension, then the webpage can put code in the DOM and let Angular execute it from within the extension. This seems to be a fundamental part of Angular 1.x's design. It just isn't built for this use case.

Re: Angular 1.x Banned from Firefox Addons

#35

Post by water42 »

nathancahill wrote: post #25
water42 wrote: post #15

For all we know Mozilla is complicit in the black market sale of this vuln by the mystery security researcher. Given Angular 1's popularity, Mozilla has a moral obligation to responsibly disclose this bug to the Angular team and let them determine if its unsolvable or not. Hinting at its existence is one of the worst things they could have done since it will simply give other blackhats motivation to find this vuln wh…

This is a bad comment. You're fear mongering and conjecturing conspiracy theories that don't exist.

I'd agree if I actually framed it as a legitimate theory. But I didn't.

Re: Angular 1.x Banned from Firefox Addons

#36

Post by Jare »

BHSPitMonkey wrote: post #17

If there is some permutation of JavaScript statements (library or otherwise) that displays a security vulnerability for the user, isn't that the browser's fault and not the application's? And isn't library detection just a hacky substitute for an actual fix of said fault?

The extension has access to certain information provided by the user and the browser. Due to a vulnerability, that information is no longer secure, and may be used in ways that the user of the extension does not expect nor has approved. The platform holder treats vulnerable extensions as if they were effectively malware, and bans them.

Hard to go deeper without further information, but it makes sense to me.

Re: Angular 1.x Banned from Firefox Addons

#38

Post by willvarfar »

water42 wrote: post #15

For all we know Mozilla is complicit in the black market sale of this vuln by the mystery security researcher. Given Angular 1's popularity, Mozilla has a moral obligation to responsibly disclose this bug to the Angular team and let them determine if its unsolvable or not. Hinting at its existence is one of the worst things they could have done since it will simply give other blackhats motivation to find this vuln wh…

Occam says that the security researcher has notified critically affected parties through the normal channels and Mozilla and others are embargoed from talking about it until its been fixed?

Re: Angular 1.x Banned from Firefox Addons

#39

Post by AgentME »

laurent123456 wrote: post #26

That doesn't make much sense. If there's a vulnerability in Angular, doesn't it mean that there's a vulnerability in the JS engine that runs the Firefox addons? And in that case, can't an attacker replicates whatever Angular is doing to make an exploit? Basically it sounds like it's something for Mozilla to fix, not the Angular team.

Angular runs eval-like functions on HTML in the DOM. The DOM can be controlled by the webpage. When Angular runs in an extension (which has more permissions than the page) using the DOM controlled by the webpage, then the webpage can write code into the DOM that Angular executes from within the extension's security context. It's not the browser's fault that Angular trusts the webpage's DOM like that; Angular just isn't built for extensions.

Re: Angular 1.x Banned from Firefox Addons

#40

Post by talmand »

Gigablah wrote: post #31
nathancahill wrote: post #13

Earlier quoted context omitted.

It's possible that the vulnerability only effects Angular running in Firefox addons, and not the general web. Mozilla takes an aggressive stance on what they allow in vetted browser extensions, as they should. JS in addons runs in a different, more privileged environment than normal web pages, and isn't restricted by things like same-origin (although this is improving with Firefox's new extension APIs). Any project t…

In other words, the vulnerability is with Firefox instead of Angular?

I would say it's both.
Post reply on HN