Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

The banned version is the 1.5.8. Could the following announce be related?

Angular 1.6 - Expression Sandbox Removal: https://angularjs.blogspot.mx/2016/09/angular-16-expression-...



Some examples of issues with the old sandbox can be found here: http://www.slideshare.net/x00mario/an-abusive-relationship-w...

The expression sandbox was not secure (and would be extremely difficult and heavily bloat the size of Angular to secure) and was not intended to be secure. It only blacklisted specific known attacks. As your link says, they removed it because people kept thinking it was a security feature they could rely on.

Angular runs eval on the page DOM. This isn't secure when the page DOM is controlled by an attacker (such as a webpage trying to elevate into an extension's privileges). Angular 1.x is the wrong tool to use within page extensions.


removing the sandbox just removes the illusion of being protected.


Correct, now it should be clear for all that Angular v1 is dangerous thing by design and it should not be used at all. Most likely a lot of not very experienced developers do for example $watch on value provided by the user input and that's a 100% XSS vulnerability since $watch does evaluate value if that was a string. And $watch is just a one example, there is a list of methods that do expressions evaluation.


Note that in the context of a browser extension an "XSS vulnerability" means "a web page just got to run code with the extension's privileges"....

[Disclaimer: I work for Mozilla.]


I guess extension's privileges means more privileges than a regular web page has (accessing file system for example?), if so then it's even more dramatic.


Right. Extensions have more privileges than normal web pages.

For the specific case here (webextensions), the extension asks for a list of permissions at install time, so which privileges it has, exactly, depends on the extension. https://developer.chrome.com/extensions/declare_permissions has documentation on what the various permissions you can request are.


You are making wrong conslusions.

> Angular v1 is dangerous thing by design

It is not dangerous. The vulnerability appears when incompetent developer injects Angular into a web page from a browser extension in Firefox (I don't know whether it would work in other browsers because they have other extension architecture).




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: