Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Angular 1.x Banned from Firefox Addons

github.com

Post reply on HN
Print view View original

111–120 of 222 posts

Re: Angular 1.x Banned from Firefox Addons

#111

Post by [deleted] »

rifung wrote: post #68
nchelluri wrote: post #55

Earlier quoted context omitted.

I am not sure that I agree. It's hard for me to say where the responsibility for disclosure lies, but if I was Mozilla I'd need to find a good reason not to disclose such a vulnerability to the project owner/development team. I am not sure that being asked not to disclose is a good enough reason without further justification; in fact it seems like a poor reason to me. Mozilla is in my view kind of a shepherd for inte…

Well, first of all if they disclosed it they would likely be sued for violating an NDA. Secondly, this would set a bad precedent because now who would ever trust Mozilla with a vulnerability that's behind an NDA?

[deleted]

Re: Angular 1.x Banned from Firefox Addons

#112

Post by AgentME »

codedokode wrote: post #101
nathancahill wrote: post #45

Earlier quoted context omitted.

Not necessarily. JS in addons has to run in a more privileged environment to interact with the browser. However, that makes it possible to write insecure addons. In this case, Angular 1.x might contain the insecure code. For example: arbitrary user input from a web page is passed to the addon. Angular handles it, and does "eval-like things"[0] with it. Now the attacker is running arbitrary code in a privileged enviro…

You can find same kind of "vulnerability" in jQuery: $(element).html(user input); This will evaluate scripts in "user input". Does this mean jQuery is vulnerable? No, it just means you are doing something wrong with it. UPD: I was wrong, jQuery inserts a script tag into DOM instead of directly calling eval() so the code above is not equivalent to eval and is another type of vulnerability.

jQuery doesn't do that on its own by default just by the act of loading it though. Angular does.

Re: Angular 1.x Banned from Firefox Addons

#113

Post by codedokode »

vladimir-y wrote: post #77
phs2501 wrote: post #6

So someone found some sort of vulnerability in Angular 1, told Mozilla about it, but told them not to tell the Angular team? What is going on here?

It's not the "some sort of vulnerability", it's a critical vulnerability in the design of the Angular v1, a long known vulnerability in fact.

This "vulnerability" can be only exploited in specific cases when Angular is used in an unintended way - for example, injected in a web page from extension context in Firefox (which is wrong anyway because it would conflict with scripts on the page).

I tried to understand whether the same is possible in Chrome - injected scripts there have less privileges and use some form of isolation - but the manual [1] doesn't give a clear answer. The injected (and exploited) content script has lower privileges than an extension but has some API methods not available to scripts on a page. For example it can send messages to an extension and it could be exploited too.

But generally Chrome extension architecture provides more isolation and looks more secure especially when extensions are written by not very experienced developers.

[1] https://developer.chrome.com/extensions/content_scripts

UPD: Firefox uses the same security model for its web extensions as Chrome so both browsers are equally vulnerable.

Re: Angular 1.x Banned from Firefox Addons

#114

Post by AgentME »

secmax wrote: post #58
nathancahill wrote: post #45

Earlier quoted context omitted.

Not necessarily. JS in addons has to run in a more privileged environment to interact with the browser. However, that makes it possible to write insecure addons. In this case, Angular 1.x might contain the insecure code. For example: arbitrary user input from a web page is passed to the addon. Angular handles it, and does "eval-like things"[0] with it. Now the attacker is running arbitrary code in a privileged enviro…

So a vulnerability of this kind would not only affect Firefox but also Chrome and others?

Most likely. Angular evals stuff from the DOM. Chrome extensions share the DOM with the webpage like Firefox extensions.

Re: Angular 1.x Banned from Firefox Addons

#115

Post by jMyles »

mschuster91 wrote: post #50

What is justifying this? If the vulnerable part is in Angular, there's a 100% chance that someone can write code in plain JS that is vulnerable to the same attack. E.g. if there was something in the hashbang-url-router that would lead to eval'ing the code in the hash (which I just made up, but would describe such a class of vulnerability). This means it's pointless to ban Angular. If something Angular does triggers a…

> there's a 100% chance that someone can write code in plain JS that is vulnerable to the same attack

This is plainly false - please don't spread fear where it doesn't belong.

I'm sure you can think of some things that, when written into the privileged environment of an addon, create vulnerabilities that aren't possible in "plain JS."

There is nowhere near a "100% chance" that this is a problem for web apps that don't run as browser extensions.

Re: Angular 1.x Banned from Firefox Addons

#116

Post by icebraining »

nchelluri wrote: post #55
vosper wrote: post #49

Earlier quoted context omitted.

There's a world of difference between an exploit being known to someone and that exploit being put up for sale on the black market. In either case, if the researcher who found the exploit sold it, that hardly makes Mozilla complicit in his actions.

I am not sure that I agree. It's hard for me to say where the responsibility for disclosure lies, but if I was Mozilla I'd need to find a good reason not to disclose such a vulnerability to the project owner/development team. I am not sure that being asked not to disclose is a good enough reason without further justification; in fact it seems like a poor reason to me. Mozilla is in my view kind of a shepherd for inte…

Isn't it a little soon to be judging them at all? We don't even know if this affects regular use of Angular (on websites) rather than just on rare use cases like browser extensions.

Re: Angular 1.x Banned from Firefox Addons

#117

Post by masklinn »

secmax wrote: post #91
TheRealPomax wrote: post #79

Note that the Angular team is working with Mozilla and the researcher on this (see https://github.com/mozilla/addons-linter/issues/1000#issueco... ) and that NDAs are a real, if insane, thing still to this day, and there is literally no way to legally compel any party to admit to being under NDA except in a court of law. Should the researcher have told the Angular team? Yes. Should they have told the entire world? Pr…

> As long as the parties are talking (which they are), this is an unfinished security review on lock-down to prevent exploitation in the interrim. I agree! There are a lot of Chrome extensions out there which could be affected. Immediate public disclose would be irresponsible.

Chrome extensions are less of an issue though, no? IIRC Firefox addons are significantly more powerful than Chrome extensions, so locking things down tighter makes sense anyway, a low threat on Chrome could be much higher on FF.

Re: Angular 1.x Banned from Firefox Addons

#118

Post by ben_jones »

TAForObvReasons wrote: post #92
DannyBee wrote: post #60

So, there's so many problems with this i don't know where to begin. Since folks have already noted the "not notifying google" issue, let me point out another: Prior to banning, i can find literally no discussion or details about this being about to happen (IE no notice), pretty much ever. You can see it was initially noted here: https://github.com/mozilla/addons-linter/commit/86f4dfb44355... I can find no discussion…

> Instead, it looks like the only way you would have found out about it is by trying to lint an extension and see it banned (IE after you developed it) It's one of the big dangers of a "walled garden": you are subject to the whims of the arbiter.

I wonder if any business-critical apps stopped working because of this?

Re: Angular 1.x Banned from Firefox Addons

#119

Post by michaelt »

TheRealPomax wrote: post #79

Note that the Angular team is working with Mozilla and the researcher on this (see https://github.com/mozilla/addons-linter/issues/1000#issueco... ) and that NDAs are a real, if insane, thing still to this day, and there is literally no way to legally compel any party to admit to being under NDA except in a court of law. Should the researcher have told the Angular team? Yes. Should they have told the entire world? Pr…

  NDAs are a real, if insane, thing still to this day
Some of the big security bugs recently have been disclosed to big players like Google and AWS before they were publicly disclosed.

If you want to retain that privilege, you need to show you can keep your mouth shut when security researchers disclose something to you - NDA or otherwise.

Re: Angular 1.x Banned from Firefox Addons

#120

Post by threatofrain »

moron4hire wrote: post #33
yc-kraln wrote: post #16

"we were not able to report them to angular as the security researcher who found them asked us to not share them." Nice.

I read that and said a literal WTF. How is it at all acceptable to honor such a request? What possible good reason could there be? Unless the discloser was the US Government and the request was actually a court order. But this seems ludicrous. If they require secrecy around the exploit, they wouldn't have disclosed it to Mozilla at all.

Mozilla is definitely in a position to reject NDA protected security information, but then they wouldn't have been privy to the security information which a researcher was conditionally offering.

Would it be better to reject the information outright? Or would you suggest that Mozilla make agreements in bad faith, deceitfully agreeing to terms they don't intend to honor?

Post reply on HN