Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Angular 1.x Banned from Firefox Addons

github.com

Post reply on HN
Print view View original

41–50 of 222 posts

Re: Angular 1.x Banned from Firefox Addons

#41

Post by sparky_z »

martey wrote: post #27
xxkylexx wrote: post #12

Earlier quoted context omitted.

No, the engineer is asking for more information so that he can determine if the application is truly affected by some unpublished Angular vulnerability or if Mozilla is just being too aggressive with their ban hammer because someone said "Angular 1.x was no longer being officially supported", which is false.

I think encoderer was referring to https://github.com/mozilla/addons-linter/issues/1000#issueco... , where the engineer asks, "Is there any possible way for us to get around this ban?"

Followed up immediately with "Are all parts of Angular affected?" The charitable interpretation is that he is asking "is there a safe subset of Angular that we can use instead of a blanket ban?".

Re: Angular 1.x Banned from Firefox Addons

#43

Post by dasil003 »

Gigablah wrote: post #31
nathancahill wrote: post #13

Earlier quoted context omitted.

It's possible that the vulnerability only effects Angular running in Firefox addons, and not the general web. Mozilla takes an aggressive stance on what they allow in vetted browser extensions, as they should. JS in addons runs in a different, more privileged environment than normal web pages, and isn't restricted by things like same-origin (although this is improving with Firefox's new extension APIs). Any project t…

In other words, the vulnerability is with Firefox instead of Angular?

No, that's the facile assumption to enable finger-pointing. My money is on an interaction between two legitimate design choices when considered independently.

Re: Angular 1.x Banned from Firefox Addons

#44

Post by AgentME »

Gigablah wrote: post #31
nathancahill wrote: post #13

Earlier quoted context omitted.

It's possible that the vulnerability only effects Angular running in Firefox addons, and not the general web. Mozilla takes an aggressive stance on what they allow in vetted browser extensions, as they should. JS in addons runs in a different, more privileged environment than normal web pages, and isn't restricted by things like same-origin (although this is improving with Firefox's new extension APIs). Any project t…

In other words, the vulnerability is with Firefox instead of Angular?

No, the vulnerability specifically has to do with Angular within extensions. Angular trusts the page DOM and uses eval-like functions on code within it. This is relatively fine if the DOM isn't controlled by someone else, but in cases where the DOM is controlled by someone with less permissions (ie. Angular is running in a higher-privilege extension, and the DOM is controlled by some webpage), then then an attacker can elevate their permissions by writing code into the DOM and letting Angular execute it within the extension.

Re: Angular 1.x Banned from Firefox Addons

#45

Post by nathancahill »

Gigablah wrote: post #31
nathancahill wrote: post #13

Earlier quoted context omitted.

It's possible that the vulnerability only effects Angular running in Firefox addons, and not the general web. Mozilla takes an aggressive stance on what they allow in vetted browser extensions, as they should. JS in addons runs in a different, more privileged environment than normal web pages, and isn't restricted by things like same-origin (although this is improving with Firefox's new extension APIs). Any project t…

In other words, the vulnerability is with Firefox instead of Angular?

Not necessarily. JS in addons has to run in a more privileged environment to interact with the browser. However, that makes it possible to write insecure addons. In this case, Angular 1.x might contain the insecure code.

For example: arbitrary user input from a web page is passed to the addon. Angular handles it, and does "eval-like things"[0] with it. Now the attacker is running arbitrary code in a privileged environment.

[0] eval-like things is a core part of how Angular works. So the vulnerability doesn't necessarily apply to Angular 1.x in a normal web page. But it wasn't designed to be run with higher privileges.

Re: Angular 1.x Banned from Firefox Addons

#46

Post by lucb1e »

water42 wrote: post #35
nathancahill wrote: post #25

Earlier quoted context omitted.

This is a bad comment. You're fear mongering and conjecturing conspiracy theories that don't exist.

I'd agree if I actually framed it as a legitimate theory. But I didn't.

What do you mean by claiming to not have framed it as a legitimate theory; you're saying it's an illegitimate theory, as in, you yourself don't believe it's true?

Re: Angular 1.x Banned from Firefox Addons

#47

Post by Jare »

moron4hire wrote: post #33
yc-kraln wrote: post #16

"we were not able to report them to angular as the security researcher who found them asked us to not share them." Nice.

I read that and said a literal WTF. How is it at all acceptable to honor such a request? What possible good reason could there be? Unless the discloser was the US Government and the request was actually a court order. But this seems ludicrous. If they require secrecy around the exploit, they wouldn't have disclosed it to Mozilla at all.

Mozilla is probably unable to disclose not just the vulnerability, but other surrounding info they may have been provided, including which other parties have received that info. They are not saying the Angular team is unaware of the problem, right? Only that they themselves are not the ones reporting it.

If you don't honor such request without a VERY STRONG reason, nobody in their right mind will ever disclose anything to you ever again. Right now we don't and can't know if such a strong reason exists.

Re: Angular 1.x Banned from Firefox Addons

#48

Post by sgc »

mlent wrote: post #14
wnevets wrote: post #3

Earlier quoted context omitted.

Yeah that doesn't sound true at all.

Was recently at an angular conference -- they said they would continue to support it until the _majority_ of the community had made the switch. That's so far from happening, I imagine they'll be supporting it for years.

At least until they get tired and change their minds, which may not take that long.

Re: Angular 1.x Banned from Firefox Addons

#49

Post by vosper »

nchelluri wrote: post #29
vosper wrote: post #22

Earlier quoted context omitted.

> For all we know Mozilla is complicit in the black market sale of this vuln by the mystery security researcher. That's a ridiculous claim

I can't help but think that he's right though. Not explicitly but implicitly. By keeping the vulnerability from the dev team they're allowing it to stay out in the wild. No? Edit: It may be that this is only an issue inside of Firefox extensions (addons). In which case, maybe the point is moot. See: https://github.com/mozilla/addons-linter/blob/master/docs/th...

There's a world of difference between an exploit being known to someone and that exploit being put up for sale on the black market. In either case, if the researcher who found the exploit sold it, that hardly makes Mozilla complicit in his actions.

Re: Angular 1.x Banned from Firefox Addons

#50

Post by mschuster91 »

What is justifying this?

If the vulnerable part is in Angular, there's a 100% chance that someone can write code in plain JS that is vulnerable to the same attack. E.g. if there was something in the hashbang-url-router that would lead to eval'ing the code in the hash (which I just made up, but would describe such a class of vulnerability). This means it's pointless to ban Angular.

If something Angular does triggers an issue in the Firefox JS engine, it is Firefox that should be fixed, instead of allowing essentially a 0day exploit to be alive.

Post reply on HN