Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Angular 1.x Banned from Firefox Addons

github.com

Post reply on HN
Print view View original

201–210 of 222 posts

Re: Angular 1.x Banned from Firefox Addons

#201

Post by hueving »

codedokode wrote: post #104
secmax wrote: post #91

Earlier quoted context omitted.

> As long as the parties are talking (which they are), this is an unfinished security review on lock-down to prevent exploitation in the interrim. I agree! There are a lot of Chrome extensions out there which could be affected. Immediate public disclose would be irresponsible.

This "vulnerability" is harder to exploit in Chrome because extensions in Chrome (unlike in Firefox) have their own private DOM, and settings page have isolated DOM too. If an extension uses Angular only with its private DOM there is no vulnerability. The vulnerability can be exploited only if an extension is running Angular on an untrusted page which is less likely in Chrome (but of course one should not underestima…

>UPD: @bzbarsky noted that Firefox...

Don't update your post to include replies to your own comment. Hackernews already allows us to see the replies. If you have a response to a comment, reply to that comment.

Re: Angular 1.x Banned from Firefox Addons

#202

Post by byuu »

dancek wrote: post #159

Many commenters here seem to be completely misunderstanding the situation. Browser extensions are really dangerous; if you need to keep your machine secure, you shouldn't use any IMHO. By definition, browser extensions need to be able to access things such as page content. What would stop someone from writing a extension that captures your bank credentials? Nothing. Obviously no security-conscious user is going to in…

> By definition, browser extensions need to be able to access things such as page content. What would stop someone from writing a extension that captures your bank credentials? Nothing.

Completely agreed. This is why it's so frustrating that all of the browser vendors have moved to this, "gut every minor option/feature possible, people can just get an extension" attitude.

For Firefox:

* removing the option to not maintain download history

* removing the option for the compact drop-down menu from the URL bar

* forcing tabs on top

* forcing refresh button to the right-hand side of the interface

For Chrome:

* removing backspace navigation (you may dislike it, but others don't)

* disabling middle-click to scroll on Linux

* removing the option to set your new tab page (eg to about:blank)

* not letting you prevent HTML5 video autoplay

* not letting you disable WebRTC

Just the backspace extension alone requires basically carte blanche access to everything just to be able to insert a tiny Javascript function to catch the keypress.

I'm not asking for us to go back to the Mozilla suite with integrated mail client, news reader, etc. Just ... it's okay to have an "advanced options" section that lets us control some of this really simple, really basic stuff. And not only okay, a major security benefit to do so. All the focus on web security, you'd think they'd take this stuff more seriously.

Re: Angular 1.x Banned from Firefox Addons

#203

Post by dancek »

Nitramp wrote: post #195
dancek wrote: post #159

Many commenters here seem to be completely misunderstanding the situation. Browser extensions are really dangerous; if you need to keep your machine secure, you shouldn't use any IMHO. By definition, browser extensions need to be able to access things such as page content. What would stop someone from writing a extension that captures your bank credentials? Nothing. Obviously no security-conscious user is going to in…

Hey. I work on security for Angular. > It's probably possible to sanitize all external inputs used in the browser extension such that privilege escalation isn't possible, but the Angular team has tried hard with their sandbox solution with no success. Extension developers will hardly do much better, so it makes sense for Mozilla to ban the whole library. AngularJS runs expressions that are in your page's HTML when it…

Thanks for the reply. I mistook the sandbox to be related to $sce. It's been a while since I last coded Angular.

So you're saying that Mozilla is mistaken in their decision, and the only way for page content to be eval'd with extension privileges is if the developer was careless with ng-bind-html or $compile?

Re: Angular 1.x Banned from Firefox Addons

#204

Post by Nitramp »

dancek wrote: post #203
Nitramp wrote: post #195

Earlier quoted context omitted.

Hey. I work on security for Angular. > It's probably possible to sanitize all external inputs used in the browser extension such that privilege escalation isn't possible, but the Angular team has tried hard with their sandbox solution with no success. Extension developers will hardly do much better, so it makes sense for Mozilla to ban the whole library. AngularJS runs expressions that are in your page's HTML when it…

Thanks for the reply. I mistook the sandbox to be related to $sce. It's been a while since I last coded Angular. So you're saying that Mozilla is mistaken in their decision, and the only way for page content to be eval'd with extension privileges is if the developer was careless with ng-bind-html or $compile?

It's a bit more complicated.

Yes, Angular itself is fine, and there's no problem with escaping or eval'ing per se.

However there is a corner condition in which Angular being present in an extension might weaken some security measures. It requires multiple issues to happen together, including the victim page being vulnerable in the first place. I'm actually not sure if that is the issue that Mozilla was thinking about, but it is a problem. We will put some defense in depth into Angular to mitigate this, but I believe it's a general issue with how extensions are handled, not limited to Angular.

Sorry for being a bit vague, but no patch has been released yet.

Re: Angular 1.x Banned from Firefox Addons

#205

Post by seanwilson »

Nitramp wrote: post #195
dancek wrote: post #159

Many commenters here seem to be completely misunderstanding the situation. Browser extensions are really dangerous; if you need to keep your machine secure, you shouldn't use any IMHO. By definition, browser extensions need to be able to access things such as page content. What would stop someone from writing a extension that captures your bank credentials? Nothing. Obviously no security-conscious user is going to in…

Hey. I work on security for Angular. > It's probably possible to sanitize all external inputs used in the browser extension such that privilege escalation isn't possible, but the Angular team has tried hard with their sandbox solution with no success. Extension developers will hardly do much better, so it makes sense for Mozilla to ban the whole library. AngularJS runs expressions that are in your page's HTML when it…

> The sandbox was never intended to be a security feature, but rather a feature to keep developers from shooting into their own foot (e.g. by creating global variables). It was considered to be defense-in-depth mechanism for a while, but it turns out it is at best misleading for users who believe it protects them. That is why we removed it.

For apps using Angular 1.5, do any changes need to be made to move up to Angular 1.6 without the sandbox? Does Angular lose any features with the removal of the sandbox?

Re: Angular 1.x Banned from Firefox Addons

#206

Post by fuzzy2 »

dancek wrote: post #159

Many commenters here seem to be completely misunderstanding the situation. Browser extensions are really dangerous; if you need to keep your machine secure, you shouldn't use any IMHO. By definition, browser extensions need to be able to access things such as page content. What would stop someone from writing a extension that captures your bank credentials? Nothing. Obviously no security-conscious user is going to in…

> By definition, browser extensions need to be able to access things such as page content.

On Firefox/XUL maybe. Web Extensions (like in Chrome) work much like Android apps: You need to acknowledge their desired permissions up front. They can’t request more later.

Of course you may need these permissions to create your extension.

Re: Angular 1.x Banned from Firefox Addons

#207

Post by y0ghur7_xxx »

fuzzy2 wrote: post #206
dancek wrote: post #159

Many commenters here seem to be completely misunderstanding the situation. Browser extensions are really dangerous; if you need to keep your machine secure, you shouldn't use any IMHO. By definition, browser extensions need to be able to access things such as page content. What would stop someone from writing a extension that captures your bank credentials? Nothing. Obviously no security-conscious user is going to in…

> By definition, browser extensions need to be able to access things such as page content. On Firefox/XUL maybe. Web Extensions (like in Chrome) work much like Android apps: You need to acknowledge their desired permissions up front. They can’t request more later. Of course you may need these permissions to create your extension.

The vulnerability described by op applies to chrome just the same. Once the addon has `pageCapture` permission, an angular 1 exploit would work just the same.

Re: Angular 1.x Banned from Firefox Addons

#208

Post by masklinn »

bzbarsky wrote: post #135
masklinn wrote: post #117

Earlier quoted context omitted.

Chrome extensions are less of an issue though, no? IIRC Firefox addons are significantly more powerful than Chrome extensions, so locking things down tighter makes sense anyway, a low threat on Chrome could be much higher on FF.

The discussion here is about Firefox webextensions, which use the Chrome extension API and are not supposed to be more powerful than Chrome extensions.

Ah that wasn't clear so I assumed it was addons in general. Thanks.

Re: Angular 1.x Banned from Firefox Addons

#209

Post by masklinn »

jaredsohn wrote: post #124
masklinn wrote: post #117

Earlier quoted context omitted.

Chrome extensions are less of an issue though, no? IIRC Firefox addons are significantly more powerful than Chrome extensions, so locking things down tighter makes sense anyway, a low threat on Chrome could be much higher on FF.

>IIRC Firefox addons are significantly more powerful than Chrome extensions I think that is only if you use the C++ API and that this post is talking about their JavaScript API.

> I think that is only if you use the C++ API

No, historical XPI addons are in JS (and XML and CSS). While they can bundle native code most don't, but they run in at the same privilege level as the browser itself (consider Firebug, which was and still is an addon).

Post reply on HN