81–90 of 222 posts
So someone found some sort of vulnerability in Angular 1, told Mozilla about it, but told them not to tell the Angular team? What is going on here?
It is possible that the researcher also secretly shared the results with Google, but then nothing happened?
On the contrary - they reacted removing sandbox completely giving up handling sandbox bypassing snippets, the problem is in the design of the framework and it can't be just fixed.
The banned version is the 1.5.8. Could the following announce be related? Angular 1.6 - Expression Sandbox Removal: https://angularjs.blogspot.mx/2016/09/angular-16-expression-...
The expression sandbox was not secure (and would be extremely difficult and heavily bloat the size of Angular to secure) and was not intended to be secure. It only blacklisted specific known attacks. As your link says, they removed it because people kept thinking it was a security feature they could rely on.
Angular runs eval on the page DOM. This isn't secure when the page DOM is controlled by an attacker (such as a webpage trying to elevate into an extension's privileges). Angular 1.x is the wrong tool to use within page extensions.
Earlier quoted context omitted.
If you're the engineer in question (since your comment history suggests you work at Bitwarden), you should explicitly state that and explain that ignoring any vulnerability was not the intent of your comment.
Thanks. I updated the comment.
If you had done in this case, it would have immediately cleared up encoderer's questions about your Github comment.
Ugh, this kind of thing gets my blood boiling. It was clearly said that _a security researcher_ disallowed Mozilla from reporting the vulnerability forward. It's the individual to blame, not Mozilla. In any case Personally I wouldn't want to run a large priviledged application as a browser extension when it's interacting with random webpages AND handling my security credentials. Too much attack surface.
Curious, do you use a password wallet/manager application, and if so how do you get passwords out of it and into the browser? I'd like to know if there's a better solution. (I use a browser extension.)
Don't just take my word for it: https://twitter.com/taviso/status/769378052254015488
There were a few high profile ones recently reported by Tavis, but there have been many in the past, and it looks like no brand of password manager has consistently written safe browser extensions. They're written to be slick-looking and convenient, the actual security isn't visible enough to be a sales/popularity boost so it suffers. This very story/issue is another example in the making.
Earlier quoted context omitted.
I think encoderer was referring to https://github.com/mozilla/addons-linter/issues/1000#issueco... , where the engineer asks, "Is there any possible way for us to get around this ban?"
Followed up immediately with "Are all parts of Angular affected?" The charitable interpretation is that he is asking "is there a safe subset of Angular that we can use instead of a blanket ban?".
Why no "woah, our other angular apps could be affected, is there any safe subset of angular 1?"
There aren't many products where security matters THAT much. I'd hope that the people working on password managers have a total security first mindset.
Earlier quoted context omitted.
Angular runs eval-like functions on HTML in the DOM. The DOM can be controlled by the webpage. When Angular runs in an extension (which has more permissions than the page) using the DOM controlled by the webpage, then the webpage can write code into the DOM that Angular executes from within the extension's security context. It's not the browser's fault that Angular trusts the webpage's DOM like that; Angular just isn…
But Angular only reads HTML that it's told to read, specified by the "ng-app" attribute/directive.
The banned version is the 1.5.8. Could the following announce be related? Angular 1.6 - Expression Sandbox Removal: https://angularjs.blogspot.mx/2016/09/angular-16-expression-...
removing the sandbox just removes the illusion of being protected.
Angular 1.x is still quite being actively developed and it will be many years before it will become unsupported. I'm sure if they report the vulnerability it would be fixed instantly seeing the amount of activity on github.
Note that the Angular team is working with Mozilla and the researcher on this (see https://github.com/mozilla/addons-linter/issues/1000#issueco... ) and that NDAs are a real, if insane, thing still to this day, and there is literally no way to legally compel any party to admit to being under NDA except in a court of law. Should the researcher have told the Angular team? Yes. Should they have told the entire world? Pr…
Let's be good GH citizens. :-) Nobody benefits from the Issue ending up locked because the discussion got too off-topic.