Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Angular 1.x Banned from Firefox Addons

github.com

Post reply on HN
Print view View original

191–200 of 222 posts

Re: Angular 1.x Banned from Firefox Addons

#191

Post by rtpg »

dancek wrote: post #159

Many commenters here seem to be completely misunderstanding the situation. Browser extensions are really dangerous; if you need to keep your machine secure, you shouldn't use any IMHO. By definition, browser extensions need to be able to access things such as page content. What would stop someone from writing a extension that captures your bank credentials? Nothing. Obviously no security-conscious user is going to in…

But the issue of preventing arbitrary Javascript code from running based on user input isn't limited to Angular, it's a problem since the beginning of time!

What about Angular is so special that it needs to be blacklisted? It will likely still be safer than ad-hoc client-side templating that people will do instead.

Re: Angular 1.x Banned from Firefox Addons

#195

Post by Nitramp »

dancek wrote: post #159

Many commenters here seem to be completely misunderstanding the situation. Browser extensions are really dangerous; if you need to keep your machine secure, you shouldn't use any IMHO. By definition, browser extensions need to be able to access things such as page content. What would stop someone from writing a extension that captures your bank credentials? Nothing. Obviously no security-conscious user is going to in…

Hey. I work on security for Angular.

> It's probably possible to sanitize all external inputs used in the browser extension such that privilege escalation isn't possible, but the Angular team has tried hard with their sandbox solution with no success. Extension developers will hardly do much better, so it makes sense for Mozilla to ban the whole library.

AngularJS runs expressions that are in your page's HTML when it initializes (or when you explicitly call angular.bootstrap on an element), but only on the page where it is loaded. If an extension uses Angular within the extension, that's perfectly fine, security wise. Unless the developer explicitly requests it, pages visited cannot move code into an extension's context (which would be dangerous in any case, Angular or not).

Even when the developer explicitly moves data from a web page into the extension context, this does not cause a security issue, even when the data ends up in the DOM. Once loaded, Angular does not revisit the DOM to run expressions in it (otherwise all Angular pages would be compromised). Care has to be taken when using things like ng-bind-html, but the security profile for an extension is the same as a regular web page here. With Angular's $sce service and automatic escaping/sanitizing, it's actually reasonably easy to write safe web applications that properly escape user input.

All of this is unrelated to the expression sandbox. The sandbox was never intended to be a security feature, but rather a feature to keep developers from shooting into their own foot (e.g. by creating global variables). It was considered to be defense-in-depth mechanism for a while, but it turns out it is at best misleading for users who believe it protects them. That is why we removed it.

Re: Angular 1.x Banned from Firefox Addons

#196

Post by tbrownaw »

the8472 wrote: post #181
NeutronBoy wrote: post #173

Earlier quoted context omitted.

Because big players can take remedial action prior to the bug being disclosed to protect users - for example, banning a specific framework from browser extensions.

That sounds like an unfair advantage over smaller competitors to me.

Yes. Fair is often not optimal.

Re: Angular 1.x Banned from Firefox Addons

#197

Post by tptacek »

DannyBee wrote: post #185
tptacek wrote: post #167

Earlier quoted context omitted.

Google has repeatedly been equally abrupt in making breaking changes to other people's apps/products/pages/sites to resolve security problems. I'm glad they do, and I'm glad Mozilla isn't fucking around with stuff like this either.

I'll assume this is true (not my area!): 1. Just because one guy is an idiot does not mean the other should be. 2. You know, you may want to tell people and establish a process for telling people that this is happening (ie it should not take until person files github issue asking what's up when they validate their app to know what's going to be okay and not) (and if the answer is "google doesn't do that", see #1 :P)

The people you just called idiots are demonstrably not idiots. Your company is extraordinarily lucky to employ them.

Re: Angular 1.x Banned from Firefox Addons

#198

Post by spicyj »

omouse wrote: post #99
Animats wrote: post #95

Using big external libraries in Firefox add-ons used to be totally prohibited. Jquery used to be prohibited outright. It's an undesirable practice. Add-ons operate at a higher privilege level than web pages. The low-quality webcrap that can be tolerated on a web page has no place in a privileged add-on.

Agreed and this is why React has been given a pass I think, because it's only for display purposes.

React is actively maintained and doesn't have any known security vulnerabilities.

Re: Angular 1.x Banned from Firefox Addons

#199

Post by bzbarsky »

mi_g wrote: post #178
bzbarsky wrote: post #106

Earlier quoted context omitted.

> Don't extensions have their own DOM They can. They can also manipulate the page DOM. > Why would anyone run Angular on a browser page? Because you want to manipulate its DOM and Angular is what you're familiar with? > It would probably conflict with existing application Note that it would operate on the same _DOM_ but not in the same scripting environment. That is, if you have a DOM element "foo" that comes from th…

Thanks Boris, this makes more sense. So the risk is that an add-on would inject angular 1.x into an external web site, this web site being malicious, it modifies its own DOM, so that angular would eval expressions from this DOM within the scripting environment running at a higher privilege. What if the malicious web site does something like ? On Firefox, i verified this loads angular into the web site, but what about…

> What if the malicious web site does something like That will run with the website's privileges. Just like site A loading a script from site B will run it with site A's privileges.

> the loading fails with an exception saying "chrome-extension://" is not an allowed source.

Chrome extensions (and webextensions) have a way to flag particular files as "web-exposed". Ones that are not can't be loaded via the web.

Firefox has something similar for chrome:// URIs in non-webextensions, but resource:// allows loads from the web in certain contexts, which include elements.

> Can we consider it is safe to use angular 1.x only from local add-on panels to run the user interface ?

I don't know the details of what the security issues reported on angular 1.x are, so I can't claim that it's safe or not safe. But at first blush, as long as angular is only interacting with the addon's own DOM, and the addon DOM never injects any text from a page DOM into itself, it _seems_ like it should be safe.

Re: Angular 1.x Banned from Firefox Addons

#200

Post by DannyBee »

tptacek wrote: post #197
DannyBee wrote: post #185

Earlier quoted context omitted.

I'll assume this is true (not my area!): 1. Just because one guy is an idiot does not mean the other should be. 2. You know, you may want to tell people and establish a process for telling people that this is happening (ie it should not take until person files github issue asking what's up when they validate their app to know what's going to be okay and not) (and if the answer is "google doesn't do that", see #1 :P)

The people you just called idiots are demonstrably not idiots. Your company is extraordinarily lucky to employ them.

Sorry, yes, that was crass, and i apologize. I can't edit it, sadly, anymore.

I meant it really in the sense that: You have given no reason this couldn't have been done in a fashion that provided the barest minimum of notice or information. Doing so when you can do so is the right thing, and if someone else is not doing that, that does not mean you should duplicate that process.

As far as i know, nobody has claimed otherwise, here or there.

In fact, there are a number of factual inaccuracies that seem to have been driving parts of this decision (IE "google has stopped supporting angular 1") that a trivial notice and discussion process probably would have corrected.

Past that nothing in this discussion has pointed to anything so urgent (especially given the 6+ month time period involved between the original presentation and any notice at all it was banned, and then another 6 months till now) that it required immediate action at the point they did it. If there was something, again, someone could have, at the very least, said that ("Hey, we discovered a problem, we're going to take immediate action, this may hurt. Sorry").

TL;DR I'm a fan of Ready, aim, fire, not fire, ready, aim. If it can't be done that way, fine, but no data says that this was the case here.

Post reply on HN