Angular 1.x Banned from Firefox Addons • Hacker News Board

Re: Angular 1.x Banned from Firefox Addons

#211

Post by willvarfar » Fri, Oct 21, 2016, 10:45 AM UTC

Nitramp wrote: post #204

dancek wrote: post #203

Earlier quoted context omitted.

Thanks for the reply. I mistook the sandbox to be related to $sce. It's been a while since I last coded Angular. So you're saying that Mozilla is mistaken in their decision, and the only way for page content to be eval'd with extension privileges is if the developer was careless with ng-bind-html or $compile?

It's a bit more complicated. Yes, Angular itself is fine, and there's no problem with escaping or eval'ing per se. However there is a corner condition in which Angular being present in an extension might weaken some security measures. It requires multiple issues to happen together, including the victim page being vulnerable in the first place. I'm actually not sure if that is the issue that Mozilla was thinking about…

thx for the update

Re: Angular 1.x Banned from Firefox Addons

#212

Post by iotscale » Fri, Oct 21, 2016, 12:18 PM UTC

byuu wrote: post #202

dancek wrote: post #159

Many commenters here seem to be completely misunderstanding the situation. Browser extensions are really dangerous; if you need to keep your machine secure, you shouldn't use any IMHO. By definition, browser extensions need to be able to access things such as page content. What would stop someone from writing a extension that captures your bank credentials? Nothing. Obviously no security-conscious user is going to in…

> By definition, browser extensions need to be able to access things such as page content. What would stop someone from writing a extension that captures your bank credentials? Nothing. Completely agreed. This is why it's so frustrating that all of the browser vendors have moved to this, "gut every minor option/feature possible, people can just get an extension" attitude. For Firefox: * removing the option to not mai…

Or more fine grained permissions.

They could at least make it possible choosing not to upgrade a very simple extension which we may have been personally reviewed.

I want a fixed (read: no updates) extension that does this: On key press, check if the key is backspace, when it is, check if any form element is focused, when not, go back. One line of JS, I guess three with nice formatting. If I create this, I need to submit it to the Chrome Store so Chrome won't complain about untrusted extensions.

Of course they also removed the ability to tell it that I know what I'm doing.

Re: Angular 1.x Banned from Firefox Addons

#213

Post by simias » Fri, Oct 21, 2016, 12:39 PM UTC

iotscale wrote: post #212

byuu wrote: post #202

Earlier quoted context omitted.

> By definition, browser extensions need to be able to access things such as page content. What would stop someone from writing a extension that captures your bank credentials? Nothing. Completely agreed. This is why it's so frustrating that all of the browser vendors have moved to this, "gut every minor option/feature possible, people can just get an extension" attitude. For Firefox: * removing the option to not mai…

Or more fine grained permissions. They could at least make it possible choosing not to upgrade a very simple extension which we may have been personally reviewed. I want a fixed (read: no updates) extension that does this: On key press, check if the key is backspace, when it is, check if any form element is focused, when not, go back. One line of JS, I guess three with nice formatting. If I create this, I need to sub…

I agree but unfortunately it's not a very popular design pattern these days.

Because of this I basically have no applications installed on my android smartphone since even trivial applications often end up requiring ridiculous amounts of privileges (often for relatively minor features) and of course there's no way to fine tune what you allow and what you don't.

Honestly I think that's a terrible habit to give your users, just ignore the privilege list since there's nothing you can do about it and click "sure whatever".

Devs should have to justify why the app needs the feature and I should be able to disable it if it's not critical for the application to work correctly. It would make it a bit harder to write and test those apps but it's not like it's rocket science either...

Re: Angular 1.x Banned from Firefox Addons

#214

Post by myfonj » Fri, Oct 21, 2016, 12:52 PM UTC

iotscale wrote: post #212

byuu wrote: post #202

Earlier quoted context omitted.

> By definition, browser extensions need to be able to access things such as page content. What would stop someone from writing a extension that captures your bank credentials? Nothing. Completely agreed. This is why it's so frustrating that all of the browser vendors have moved to this, "gut every minor option/feature possible, people can just get an extension" attitude. For Firefox: * removing the option to not mai…

Or more fine grained permissions. They could at least make it possible choosing not to upgrade a very simple extension which we may have been personally reviewed. I want a fixed (read: no updates) extension that does this: On key press, check if the key is backspace, when it is, check if any form element is focused, when not, go back. One line of JS, I guess three with nice formatting. If I create this, I need to sub…

Sidenote: It is pretty much exactly the Googles (alas, auto-updated) "Go Back With Backspace" [0] does: [1] (you forgot the shift backspace, Google as well in past versions).

[0] https://chrome.google.com/webstore/detail/go-back-with-backs...

[1] https://crx.dam.io/source/crxviewer.html?crx=https://crx.dam... (nice to walk trough history of this file though versions https://crx.dam.io/ext/eekailopagacbcdloonjhbiecobagjci.html )

Re: Angular 1.x Banned from Firefox Addons

#215

Post by tptacek » Fri, Oct 21, 2016, 2:23 PM UTC

DannyBee wrote: post #200

tptacek wrote: post #197

Earlier quoted context omitted.

The people you just called idiots are demonstrably not idiots. Your company is extraordinarily lucky to employ them.

Sorry, yes, that was crass, and i apologize. I can't edit it, sadly, anymore. I meant it really in the sense that: You have given no reason this couldn't have been done in a fashion that provided the barest minimum of notice or information. Doing so when you can do so is the right thing, and if someone else is not doing that, that does not mean you should duplicate that process. As far as i know, nobody has claimed o…

Sorry, I thought I had written a longer comment but got distracted, so that came out sharper than I meant.

I agree. Notice is good. But all sorts of pressures interfere with notice, like embargoes, multiple stakeholders, threat intelligence, IR and active exploitation, and so on.

The important thing is to close the vulnerability. Everything else is distantly secondary.

Also, and respectfully: it is not so much Mozilla's job to know the maintenance status of Google Javascript libraries so much as it is Google's responsibility not to ship Javascript code (or extensions) that make Mozilla insecure.

Re: Angular 1.x Banned from Firefox Addons

#216

Post by sfink » Fri, Oct 21, 2016, 3:43 PM UTC

AgentME wrote: post #188

tlrobinson wrote: post #187

Earlier quoted context omitted.

I believe you could solve the garbage collection problem with WeakMap.

Maybe if you use a WeakMap with a transferrable object and assuming that if you postMessage a transferrable object and then get it back later and still have the WeakMap recognize it as a key. I'm not very sure that last part would work. I don't think GC-links reach through iframes in a way that would enable that. WeakMaps are more limited than most people seem to expect. They're powerful tools that enable many new po…

Object identity is not preserved with Transferring or regular structured cloning. Transferring is really about the resource represented it held onto by the object being transferred.

If object identity (for the purpose of WeakMap) was preserved, your idea would provide a way to observe GC behavior. Which wouldn't automatically be a complete disaster, though I am personally dead set against it except maybe in some sort of privileged context. Weak references keep getting proposed, and there are some pretty compelling use cases, but there is also some very major risk that we could never back out of once weakrefs were available, and they could permanently hold back future GC performance. (You could easily break deployed web applications by improving GC behavior.)

(Source: I implemented Transferring in general and Transferring ArrayBuffers in particular in Spidermonkey, and I work on the GC engine. And it's nice to see a comment on HN like the parent that gets it right for once!)

Re: Angular 1.x Banned from Firefox Addons

#217

Post by Nitramp » Fri, Oct 21, 2016, 4:25 PM UTC

seanwilson wrote: post #205

Nitramp wrote: post #195

Earlier quoted context omitted.

Hey. I work on security for Angular. > It's probably possible to sanitize all external inputs used in the browser extension such that privilege escalation isn't possible, but the Angular team has tried hard with their sandbox solution with no success. Extension developers will hardly do much better, so it makes sense for Mozilla to ban the whole library. AngularJS runs expressions that are in your page's HTML when it…

> The sandbox was never intended to be a security feature, but rather a feature to keep developers from shooting into their own foot (e.g. by creating global variables). It was considered to be defense-in-depth mechanism for a while, but it turns out it is at best misleading for users who believe it protects them. That is why we removed it. For apps using Angular 1.5, do any changes need to be made to move up to Angu…

No, it's fully compatible.

Re: Angular 1.x Banned from Firefox Addons

#218

Post by emn13 » Fri, Oct 21, 2016, 6:47 PM UTC

fuzzy2 wrote: post #206

dancek wrote: post #159

Many commenters here seem to be completely misunderstanding the situation. Browser extensions are really dangerous; if you need to keep your machine secure, you shouldn't use any IMHO. By definition, browser extensions need to be able to access things such as page content. What would stop someone from writing a extension that captures your bank credentials? Nothing. Obviously no security-conscious user is going to in…

> By definition, browser extensions need to be able to access things such as page content. On Firefox/XUL maybe. Web Extensions (like in Chrome) work much like Android apps: You need to acknowledge their desired permissions up front. They can’t request more later. Of course you may need these permissions to create your extension.

Many extensions have full access to all webpages, also in chrome; there's no sandbox or anything similar safely separating extension from page. That's not a bug or missing feature: it's by design! Many extensions fiddle with all kinds of page aspects as part of their core functionality.

An adblocker that can't inspect the page dom would likely not work very well.

Re: Angular 1.x Banned from Firefox Addons

#219

Post by emn13 » Fri, Oct 21, 2016, 6:58 PM UTC

codedokode wrote: post #130

AgentME wrote: post #123

Earlier quoted context omitted.

Chrome has many many extensions which run on and modify the page DOM just like Firefox! I think it might even be reasonable to guess that around half of extensions do this.

Modifying DOM is not enough to cause a vulnerability. In Chrome content scripts (the ones that are injected into a page from an extension) have limited privileges though there still can be the ways to exploit them.

It's completely expected to both inject scripts into a pages DOM, and also to set up a communication channel back from the page content script to the central extension "process". It's not a rare corner case. An ad-blocking content script might want to report user-selected extra filter requests back to the main adblocker context; or it may simply want to count the number of blocked requests; or a password manager may want the ability to save new passwords; etc.

Typically, you'd expect the central extension to trust messages it receives from its own content scripts, so even though there is a separation between the extension and the pages it's on, the separation is by no means a leak-proof security measure; it cannot be. You rely on each and every such extension being carefully written and having no security relevant bugs.

If you think about it, it should be clear that it's practically infeasible to fix this hole. Extensions authors simply need to avoid such bugs. If angular1 somehow makes it easy for them to make mistakes when used by an extension, that's a problem.

Re: Angular 1.x Banned from Firefox Addons

#220

Post by [deleted] » Fri, Oct 21, 2016, 10:20 PM UTC

AgentME wrote: post #188

tlrobinson wrote: post #187

Earlier quoted context omitted.

I believe you could solve the garbage collection problem with WeakMap.

Maybe if you use a WeakMap with a transferrable object and assuming that if you postMessage a transferrable object and then get it back later and still have the WeakMap recognize it as a key. I'm not very sure that last part would work. I don't think GC-links reach through iframes in a way that would enable that. WeakMaps are more limited than most people seem to expect. They're powerful tools that enable many new po…

[deleted]