Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Angular 1.x Banned from Firefox Addons

github.com

Post reply on HN
Print view View original

121–130 of 222 posts

Re: Angular 1.x Banned from Firefox Addons

#121

Post by codedokode »

vladimir-y wrote: post #88
wnevets wrote: post #78

Earlier quoted context omitted.

removing the sandbox just removes the illusion of being protected.

Correct, now it should be clear for all that Angular v1 is dangerous thing by design and it should not be used at all. Most likely a lot of not very experienced developers do for example $watch on value provided by the user input and that's a 100% XSS vulnerability since $watch does evaluate value if that was a string. And $watch is just a one example, there is a list of methods that do expressions evaluation.

You are making wrong conslusions.

> Angular v1 is dangerous thing by design

It is not dangerous. The vulnerability appears when incompetent developer injects Angular into a web page from a browser extension in Firefox (I don't know whether it would work in other browsers because they have other extension architecture).

Re: Angular 1.x Banned from Firefox Addons

#122

Post by AgentME »

TheRealPomax wrote: post #79

Note that the Angular team is working with Mozilla and the researcher on this (see https://github.com/mozilla/addons-linter/issues/1000#issueco... ) and that NDAs are a real, if insane, thing still to this day, and there is literally no way to legally compel any party to admit to being under NDA except in a court of law. Should the researcher have told the Angular team? Yes. Should they have told the entire world? Pr…

The mentioned vulnerability was most likely another sandbox escape. The sandbox is described as "not a defense mechanism" by the Angular team, and the sandbox was removed entirely in the 1.6 release[0]. They admit that Angular isn't secure for cases where an attacker can control the template: this case includes extensions! I'm not going to fault someone for not reporting a security issue with an already-removed feature specifically described as not a security feature.

Before anyone misreads this: the sandbox being removed in 1.6 doesn't mean that Angular 1.6 is safe to use in extensions. It just means that Angular stopped pretending it was safe there. A fundamental part of Angular is evaling text from the DOM. If the DOM is controlled by an attacker, such as a webpage trying to elevate to extension privileges, then you're out of luck. Sandboxing eval is a very large and difficult task that would bloat Angular, all for a use-case that they are not interested in. Angular 1.x is the wrong tool for the job.

[0] http://angularjs.blogspot.com/2016/09/angular-16-expression-...

Re: Angular 1.x Banned from Firefox Addons

#123

Post by AgentME »

codedokode wrote: post #104
secmax wrote: post #91

Earlier quoted context omitted.

> As long as the parties are talking (which they are), this is an unfinished security review on lock-down to prevent exploitation in the interrim. I agree! There are a lot of Chrome extensions out there which could be affected. Immediate public disclose would be irresponsible.

This "vulnerability" is harder to exploit in Chrome because extensions in Chrome (unlike in Firefox) have their own private DOM, and settings page have isolated DOM too. If an extension uses Angular only with its private DOM there is no vulnerability. The vulnerability can be exploited only if an extension is running Angular on an untrusted page which is less likely in Chrome (but of course one should not underestima…

Chrome has many many extensions which run on and modify the page DOM just like Firefox! I think it might even be reasonable to guess that around half of extensions do this.

Re: Angular 1.x Banned from Firefox Addons

#124

Post by jaredsohn »

masklinn wrote: post #117
secmax wrote: post #91

Earlier quoted context omitted.

> As long as the parties are talking (which they are), this is an unfinished security review on lock-down to prevent exploitation in the interrim. I agree! There are a lot of Chrome extensions out there which could be affected. Immediate public disclose would be irresponsible.

Chrome extensions are less of an issue though, no? IIRC Firefox addons are significantly more powerful than Chrome extensions, so locking things down tighter makes sense anyway, a low threat on Chrome could be much higher on FF.

>IIRC Firefox addons are significantly more powerful than Chrome extensions

I think that is only if you use the C++ API and that this post is talking about their JavaScript API.

Re: Angular 1.x Banned from Firefox Addons

#126

Post by AgentME »

codedokode wrote: post #113
vladimir-y wrote: post #77

Earlier quoted context omitted.

It's not the "some sort of vulnerability", it's a critical vulnerability in the design of the Angular v1, a long known vulnerability in fact.

This "vulnerability" can be only exploited in specific cases when Angular is used in an unintended way - for example, injected in a web page from extension context in Firefox (which is wrong anyway because it would conflict with scripts on the page). I tried to understand whether the same is possible in Chrome - injected scripts there have less privileges and use some form of isolation - but the manual [1] doesn't gi…

Chrome extensions running in webpages share the DOM with the webpage. That's how they make modifications to the webpage.

They have their own javascript-wrappers around the DOM, so an extension is not vulnerable to a webpage overwriting DOM methods, but obviously the DOM still has the same content visible in it, and this can't protect extensions from using libraries which eval content within the DOM.

Re: Angular 1.x Banned from Firefox Addons

#127

Post by xorcist »

moron4hire wrote: post #33
yc-kraln wrote: post #16

"we were not able to report them to angular as the security researcher who found them asked us to not share them." Nice.

I read that and said a literal WTF. How is it at all acceptable to honor such a request? What possible good reason could there be? Unless the discloser was the US Government and the request was actually a court order. But this seems ludicrous. If they require secrecy around the exploit, they wouldn't have disclosed it to Mozilla at all.

I have no idea if that is the case here, but it is completely normal that some vulnerabilities have a set disclosure date to allow for coordinated responses. You can either get the information early but under non-disclosure, or along with everyone else. Most people play by these rules (with a few notable exceptions).

Re: Angular 1.x Banned from Firefox Addons

#128

Post by codedokode »

esafwan wrote: post #82

That suddenly makes Angular look scary for some clients. vulnerability that is known to an entity/entities but unknown to the Angular developers or contributors....

The vulnerability occurs only if you inject Angular into a web page from browser extension in some browsers. There is no vulnerability if you are writing a SPA using Angular.

Re: Angular 1.x Banned from Firefox Addons

#129

Post by angry-hacker »

Can someone explain me:

If angular can do it, so can just plain javascript? Then it's a problem with their extension architecture?

As much as I hate bundling big libraries everywhere, why ban angular?

Also, is it possible the researcher wants to get money from Google and didn't want the vulnerability to be shared?

Re: Angular 1.x Banned from Firefox Addons

#130

Post by codedokode »

AgentME wrote: post #123
codedokode wrote: post #104

Earlier quoted context omitted.

This "vulnerability" is harder to exploit in Chrome because extensions in Chrome (unlike in Firefox) have their own private DOM, and settings page have isolated DOM too. If an extension uses Angular only with its private DOM there is no vulnerability. The vulnerability can be exploited only if an extension is running Angular on an untrusted page which is less likely in Chrome (but of course one should not underestima…

Chrome has many many extensions which run on and modify the page DOM just like Firefox! I think it might even be reasonable to guess that around half of extensions do this.

Modifying DOM is not enough to cause a vulnerability. In Chrome content scripts (the ones that are injected into a page from an extension) have limited privileges though there still can be the ways to exploit them.
Post reply on HN