Angular 1.x Banned from Firefox Addons • Hacker News Board

Re: Angular 1.x Banned from Firefox Addons

#131

Post by spiznnx » Thu, Oct 20, 2016, 7:53 PM UTC

Gigablah wrote: post #31

nathancahill wrote: post #13

Earlier quoted context omitted.

It's possible that the vulnerability only effects Angular running in Firefox addons, and not the general web. Mozilla takes an aggressive stance on what they allow in vetted browser extensions, as they should. JS in addons runs in a different, more privileged environment than normal web pages, and isn't restricted by things like same-origin (although this is improving with Firefox's new extension APIs). Any project t…

In other words, the vulnerability is with Firefox instead of Angular?

Firefox wasn't designed to run Angular in an extension on webpage DOM. Angular wasn't designed to run in Firefox extensions on webpage DOM. Nether has a vulnerability, when used as designed.

It's not safe for a 3 year old to drive a car, even if there's nothing wrong with the baby or the car.

Re: Angular 1.x Banned from Firefox Addons

#132

Post by AgentME » Thu, Oct 20, 2016, 7:54 PM UTC

masklinn wrote: post #117

secmax wrote: post #91

Earlier quoted context omitted.

> As long as the parties are talking (which they are), this is an unfinished security review on lock-down to prevent exploitation in the interrim. I agree! There are a lot of Chrome extensions out there which could be affected. Immediate public disclose would be irresponsible.

Chrome extensions are less of an issue though, no? IIRC Firefox addons are significantly more powerful than Chrome extensions, so locking things down tighter makes sense anyway, a low threat on Chrome could be much higher on FF.

If a Chrome extension has permissions to an origin, then it can freely make cross-domain requests to it from any page. So if you have an extension using Angular 1.x on every page and then browse to a malicious page, then the page could contain text in the DOM that Angular evals from within the extension. That code could then make an AJAX request to any origin with your cookies, and make requests for your bank info or emails and do things like steal data or change your passwords.

Re: Angular 1.x Banned from Firefox Addons

#133

Post by the_duke » Thu, Oct 20, 2016, 7:54 PM UTC

secmax wrote: post #58

nathancahill wrote: post #45

Earlier quoted context omitted.

Not necessarily. JS in addons has to run in a more privileged environment to interact with the browser. However, that makes it possible to write insecure addons. In this case, Angular 1.x might contain the insecure code. For example: arbitrary user input from a web page is passed to the addon. Angular handles it, and does "eval-like things"[0] with it. Now the attacker is running arbitrary code in a privileged enviro…

So a vulnerability of this kind would not only affect Firefox but also Chrome and others?

Chromes extension APIs do not provide the level of access that Firefox APIs do.

Re: Angular 1.x Banned from Firefox Addons

#134

Post by codedokode » Thu, Oct 20, 2016, 7:54 PM UTC

AgentME wrote: post #114

secmax wrote: post #58

Earlier quoted context omitted.

So a vulnerability of this kind would not only affect Firefox but also Chrome and others?

Most likely. Angular evals stuff from the DOM. Chrome extensions share the DOM with the webpage like Firefox extensions.

In Chrome content scripts (the ones that are injected into a page from an extension) run in some kind of isolated mode: https://developer.chrome.com/extensions/content_scripts

Yet they have some privileges a normal script doesn't have, for example the ability to post messages to parent extension which can be exploited.

Re: Angular 1.x Banned from Firefox Addons

#135

Post by bzbarsky » Thu, Oct 20, 2016, 7:56 PM UTC

masklinn wrote: post #117

secmax wrote: post #91

Earlier quoted context omitted.

> As long as the parties are talking (which they are), this is an unfinished security review on lock-down to prevent exploitation in the interrim. I agree! There are a lot of Chrome extensions out there which could be affected. Immediate public disclose would be irresponsible.

Chrome extensions are less of an issue though, no? IIRC Firefox addons are significantly more powerful than Chrome extensions, so locking things down tighter makes sense anyway, a low threat on Chrome could be much higher on FF.

The discussion here is about Firefox webextensions, which use the Chrome extension API and are not supposed to be more powerful than Chrome extensions.

Re: Angular 1.x Banned from Firefox Addons

#136

Post by bzbarsky » Thu, Oct 20, 2016, 7:57 PM UTC

jaredsohn wrote: post #124

masklinn wrote: post #117

Earlier quoted context omitted.

Chrome extensions are less of an issue though, no? IIRC Firefox addons are significantly more powerful than Chrome extensions, so locking things down tighter makes sense anyway, a low threat on Chrome could be much higher on FF.

>IIRC Firefox addons are significantly more powerful than Chrome extensions I think that is only if you use the C++ API and that this post is talking about their JavaScript API.

It's possible to write Firefox extensions in JavaScript that are a lot more powerful than Chrome extensions (or webextensions, which are the Firefox equivalent of Chrome extensions) are. That capability is slowly being phased out, though.

Re: Angular 1.x Banned from Firefox Addons

#137

Post by bzbarsky » Thu, Oct 20, 2016, 7:58 PM UTC

codedokode wrote: post #104

secmax wrote: post #91

Earlier quoted context omitted.

> As long as the parties are talking (which they are), this is an unfinished security review on lock-down to prevent exploitation in the interrim. I agree! There are a lot of Chrome extensions out there which could be affected. Immediate public disclose would be irresponsible.

This "vulnerability" is harder to exploit in Chrome because extensions in Chrome (unlike in Firefox) have their own private DOM, and settings page have isolated DOM too. If an extension uses Angular only with its private DOM there is no vulnerability. The vulnerability can be exploited only if an extension is running Angular on an untrusted page which is less likely in Chrome (but of course one should not underestima…

Note that the github discussion is about Firefox webextensions, which have the same security model as Chrome extensions (and in fact aim to be API-compatible with Chrome extensions).

Re: Angular 1.x Banned from Firefox Addons

#138

Post by buremba » Thu, Oct 20, 2016, 8:01 PM UTC

This thing makes me believe that we should not use any OSS project which released by a big companies such as Google and Microsoft. Even if they don't say that they're dropping support, when they start to work on another project, it won't be a community-driven project and slowly die.

Re: Angular 1.x Banned from Firefox Addons

#139

Post by bzbarsky » Thu, Oct 20, 2016, 8:03 PM UTC

the_duke wrote: post #133

secmax wrote: post #58

Earlier quoted context omitted.

So a vulnerability of this kind would not only affect Firefox but also Chrome and others?

Chromes extension APIs do not provide the level of access that Firefox APIs do.

The topic of discussion here is Firefox webextensions, which are meant to be API-compatible with Chrome extensions and have the same security model.

Re: Angular 1.x Banned from Firefox Addons

#140

Post by AgentME » Thu, Oct 20, 2016, 8:06 PM UTC

codedokode wrote: post #134

AgentME wrote: post #114

Earlier quoted context omitted.

Most likely. Angular evals stuff from the DOM. Chrome extensions share the DOM with the webpage like Firefox extensions.

In Chrome content scripts (the ones that are injected into a page from an extension) run in some kind of isolated mode: https://developer.chrome.com/extensions/content_scripts Yet they have some privileges a normal script doesn't have, for example the ability to post messages to parent extension which can be exploited.

They still see the same content in the DOM. The extension just has a separate javascript-wrapper around the DOM. This means that an extension will not be affected if a webpage monkey-patches a DOM method to do something else. But if a webpage places some specific text content inside an HTML element, then the extension will see that same text content! (And Angular running in the extension can still choose to recognize that content as a template and eval it.)