Hardening the Firefox Front End with Content Security Policies
attackanddefense.dev
Hardening the Firefox Front End with Content Security Policies
1–10 of 71 posts
Re: Hardening the Firefox Front End with Content Security Policies
#2Firefox really needs to fix their CSP for extensions before this kind of thing.
Here is the 9 year old bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1267027
And their extension store does not permit workarounds, even though they themselves have confirmed it's a bug.
Re: Hardening the Firefox Front End with Content Security Policies
#3Firefox really needs to fix their CSP for extensions before this kind of thing. Here is the 9 year old bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1267027 And their extension store does not permit workarounds, even though they themselves have confirmed it's a bug.
Having fewer permissions for extensions than one might want seems fairly less important to making the browser more secure…
Re: Hardening the Firefox Front End with Content Security Policies
#4Firefox really needs to fix their CSP for extensions before this kind of thing. Here is the 9 year old bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1267027 And their extension store does not permit workarounds, even though they themselves have confirmed it's a bug.
Wouldn’t fixing this bug reduce security?
Re: Hardening the Firefox Front End with Content Security Policies
#5CSP is really great at plugging these kinds of security holes, but it flummoxes me that most developers and designers don't take them seriously enough to implement properly (styles must only be set though , and JS likewise exists only in external files). Doing any styling or scripting inline should be frowned upon as hard as table-based layouts.
Re: Hardening the Firefox Front End with Content Security Policies
#6Firefox really needs to fix their CSP for extensions before this kind of thing. Here is the 9 year old bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1267027 And their extension store does not permit workarounds, even though they themselves have confirmed it's a bug.
Wouldn’t fixing this bug reduce security?
If you are using filter scripts, to block specific domains or script payloads, that extension can't load on a properly secured CSP page. And that page may be using CSP to protect throwing up ads... Or malware.
Re: Hardening the Firefox Front End with Content Security Policies
#7I am surprised there is no policy that would allow inline event handlers set in the initial payload (or stuff emitted by document.write), but neuter any done after initial render by `….setAttribute('on…', …)`.
That would keep "static form" helpers still functional, but disable (malicious) runtime templating.
Re: Hardening the Firefox Front End with Content Security Policies
#8CSP is really great at plugging these kinds of security holes, but it flummoxes me that most developers and designers don't take them seriously enough to implement properly (styles must only be set though , and JS likewise exists only in external files). Doing any styling or scripting inline should be frowned upon as hard as table-based layouts.
> should be frowned upon as hard as table-based layouts
I absolutely agree with you. I've been very very keen on CSP for a long time, it feels SO good to know that that vector for exploiting vulnerabilities is plugged.
One thing that's very noticeable: It seems to block/break -a lot- of web extensions. Basically every error I see in Sentry is of the form of "X.js blocked" or "random script eval blocked", stuff that's all extension-related.
Re: Hardening the Firefox Front End with Content Security Policies
#9Firefox really needs to fix their CSP for extensions before this kind of thing. Here is the 9 year old bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1267027 And their extension store does not permit workarounds, even though they themselves have confirmed it's a bug.
One of the possible workarounds would be to just remove the damn header before it causes any further inconvenience. I think they do allow `webRequest` API usage in the store, don't they?
Re: Hardening the Firefox Front End with Content Security Policies
#10Firefox really needs to fix their CSP for extensions before this kind of thing. Here is the 9 year old bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1267027 And their extension store does not permit workarounds, even though they themselves have confirmed it's a bug.
While this is definitely annoying, most of the time this can be worked around by the extension without workarounds that themself weaken security.
For example I helped uBlock Origin out in 2022 when they ran into this: https://github.com/uBlockOrigin/uBlock-issues/issues/235#iss...