Angular 1.x Banned from Firefox Addons • Hacker News Board

Re: Angular 1.x Banned from Firefox Addons

#91

Post by secmax » Thu, Oct 20, 2016, 6:42 PM UTC

TheRealPomax wrote: post #79

Note that the Angular team is working with Mozilla and the researcher on this (see https://github.com/mozilla/addons-linter/issues/1000#issueco... ) and that NDAs are a real, if insane, thing still to this day, and there is literally no way to legally compel any party to admit to being under NDA except in a court of law. Should the researcher have told the Angular team? Yes. Should they have told the entire world? Pr…

> As long as the parties are talking (which they are), this is an unfinished security review on lock-down to prevent exploitation in the interrim.

I agree! There are a lot of Chrome extensions out there which could be affected. Immediate public disclose would be irresponsible.

Re: Angular 1.x Banned from Firefox Addons

#92

Post by TAForObvReasons » Thu, Oct 20, 2016, 6:42 PM UTC

DannyBee wrote: post #60

So, there's so many problems with this i don't know where to begin. Since folks have already noted the "not notifying google" issue, let me point out another: Prior to banning, i can find literally no discussion or details about this being about to happen (IE no notice), pretty much ever. You can see it was initially noted here: https://github.com/mozilla/addons-linter/commit/86f4dfb44355... I can find no discussion…

> Instead, it looks like the only way you would have found out about it is by trying to lint an extension and see it banned (IE after you developed it)

It's one of the big dangers of a "walled garden": you are subject to the whims of the arbiter.

Re: Angular 1.x Banned from Firefox Addons

#93

Post by bzbarsky » Thu, Oct 20, 2016, 6:48 PM UTC

odbol_ wrote: post #62

laurent123456 wrote: post #26

That doesn't make much sense. If there's a vulnerability in Angular, doesn't it mean that there's a vulnerability in the JS engine that runs the Firefox addons? And in that case, can't an attacker replicates whatever Angular is doing to make an exploit? Basically it sounds like it's something for Mozilla to fix, not the Angular team.

Exactly. If you can write a vulnerability in Angular, you can write it in vanilla Javascript as well. Unless Angular is using `eval()` or something and Firefox bans any use of `eval()`, which is reasonable...

> Unless Angular is using `eval()`

Which it is, as far as I can see, though it tried to make it slightly safer ... until version 1.6, when it gave up on pretending it's at all safe. The linked slide share from the github issue talks about this a bit. See http://www.slideshare.net/x00mario/an-abusive-relationship-w... slides 16-31 which talk about the sandbox angular tried to apply to the environment it did the eval() in, but in the end it's grabbing text from the DOM and doing an eval().

Note that in a browser extension doing text from the DOM (controlled by the web page) and doing an eval (with the privileges of the extension!) is obviously really really bad.

[Disclaimer: I work for Mozilla and I'm not an expert on Angular.]

Re: Angular 1.x Banned from Firefox Addons

#94

Post by bzbarsky » Thu, Oct 20, 2016, 6:49 PM UTC

jonny_eh wrote: post #72

AgentME wrote: post #39

Earlier quoted context omitted.

Angular runs eval-like functions on HTML in the DOM. The DOM can be controlled by the webpage. When Angular runs in an extension (which has more permissions than the page) using the DOM controlled by the webpage, then the webpage can write code into the DOM that Angular executes from within the extension's security context. It's not the browser's fault that Angular trusts the webpage's DOM like that; Angular just isn…

But Angular only reads HTML that it's told to read, specified by the "ng-app" attribute/directive.

Yes, but in a browser extension context the web page controls the HTML involved and is the thing you want to defend against. So relying on the HTML to play nice is not OK.

[Disclaimer: I work for Mozilla.]

Re: Angular 1.x Banned from Firefox Addons

#95

Post by Animats » Thu, Oct 20, 2016, 6:52 PM UTC

Using big external libraries in Firefox add-ons used to be totally prohibited. Jquery used to be prohibited outright. It's an undesirable practice. Add-ons operate at a higher privilege level than web pages. The low-quality webcrap that can be tolerated on a web page has no place in a privileged add-on.

Re: Angular 1.x Banned from Firefox Addons

#96

Post by bzbarsky » Thu, Oct 20, 2016, 6:54 PM UTC

vladimir-y wrote: post #88

wnevets wrote: post #78

Earlier quoted context omitted.

removing the sandbox just removes the illusion of being protected.

Correct, now it should be clear for all that Angular v1 is dangerous thing by design and it should not be used at all. Most likely a lot of not very experienced developers do for example $watch on value provided by the user input and that's a 100% XSS vulnerability since $watch does evaluate value if that was a string. And $watch is just a one example, there is a list of methods that do expressions evaluation.

Note that in the context of a browser extension an "XSS vulnerability" means "a web page just got to run code with the extension's privileges"....

[Disclaimer: I work for Mozilla.]

Re: Angular 1.x Banned from Firefox Addons

#97

Post by hannob » Thu, Oct 20, 2016, 6:54 PM UTC

I'm not sure if this is the same case, but I assume it is: if you're wondering why the researcher doesn't want to share the vuln listen to this talk: https://www.youtube.com/watch?v=U4e0Remq1WQ

Roughly at 41:30 he explains why he doesn't want to disclose the vuln. The tl;dr is he thinks the sandbox is broken beyond repair and whatever fix they come up he can create another bypass for the sandbox. But he doesn't want to do this all the time and he needs his vuln as a poc to show to customers if they abuse the sandbox.

Re: Angular 1.x Banned from Firefox Addons

#98

Post by vladimir-y » Thu, Oct 20, 2016, 6:56 PM UTC

bzbarsky wrote: post #96

vladimir-y wrote: post #88

Earlier quoted context omitted.

Correct, now it should be clear for all that Angular v1 is dangerous thing by design and it should not be used at all. Most likely a lot of not very experienced developers do for example $watch on value provided by the user input and that's a 100% XSS vulnerability since $watch does evaluate value if that was a string. And $watch is just a one example, there is a list of methods that do expressions evaluation.

Note that in the context of a browser extension an "XSS vulnerability" means "a web page just got to run code with the extension's privileges".... [Disclaimer: I work for Mozilla.]

I guess extension's privileges means more privileges than a regular web page has (accessing file system for example?), if so then it's even more dramatic.

Re: Angular 1.x Banned from Firefox Addons

#99

Post by omouse » Thu, Oct 20, 2016, 6:57 PM UTC

Animats wrote: post #95

Using big external libraries in Firefox add-ons used to be totally prohibited. Jquery used to be prohibited outright. It's an undesirable practice. Add-ons operate at a higher privilege level than web pages. The low-quality webcrap that can be tolerated on a web page has no place in a privileged add-on.

Agreed and this is why React has been given a pass I think, because it's only for display purposes.

Re: Angular 1.x Banned from Firefox Addons

#100

Post by codedokode » Thu, Oct 20, 2016, 6:59 PM UTC

AgentME wrote: post #44

Gigablah wrote: post #31

Earlier quoted context omitted.

In other words, the vulnerability is with Firefox instead of Angular?

No, the vulnerability specifically has to do with Angular within extensions. Angular trusts the page DOM and uses eval-like functions on code within it. This is relatively fine if the DOM isn't controlled by someone else, but in cases where the DOM is controlled by someone with less permissions (ie. Angular is running in a higher-privilege extension, and the DOM is controlled by some webpage), then then an attacker c…

Don't extensions have their own DOM (like they have in Chrome)? Why would anyone run Angular on a browser page? It would probably conflict with existing application.

It looks like Firefox extension architecture has design problems.

And I don't like the presentation. One could think that Angular is vulnerable which is not true. The vulnerability appears when it is used in a wrong way in a browser extension.