4 ms·

The banned version is the 1.5.8. Could the following announce be related? Angular 1.6 - Expression Sandbox Removal: https://angularjs.blogspot.mx/2016/09/angul

The banned version is the 1.5.8. Could the following announce be related? Angular 1.6 - Expression Sandbox Removal: https://angularjs.blogspot.mx/2016/09/angular-16-expression-sandbox-removal.html https://angularjs.blogspot.mx/2016/09/angular-16-expression-...

deleted 10y ago
[deleted]
wnevets 10y ago
removing the sandbox just removes the illusion of being protected.
- vladimir-y 10y ago
  Correct, now it should be clear for all that Angular v1 is dangerous thing by design and it should not be used at all. Most likely a lot of not very experienced developers do for example $watch on value provided by the user input and that's a 100% XSS vulnerability since $watch does evaluate value if that was a string. And $watch is just a one example, there is a list of methods that do expressions evaluation.
  - bzbarsky 10y ago
    Note that in the context of a browser extension an "XSS vulnerability" means "a web page just got to run code with the extension's privileges".... [Disclaimer: I work for Mozilla.]
    - vladimir-y 10y ago
      I guess extension's privileges means more privileges than a regular web page has (accessing file system for example?), if so then it's even more dramatic.
      - bzbarsky 10y ago
        Right. Extensions have more privileges than normal web pages. For the specific case here (webextensions), the extension asks for a list of permissions at install time, so which privileges it has, exactly, depends on the extension. https://developer.chrome.com/extensions/declare_permissions https://developer.chrome.com/extensions/declare_permissions has documentation on what the various permissions you can request are.
  - codedokode 10y ago
    You are making wrong conslusions. > Angular v1 is dangerous thing by design It is not dangerous. The vulnerability appears when incompetent developer injects Angular into a web page from a browser extension in Firefox (I don't know whether it would work in other browsers because they have other extension architecture).
AgentME 10y ago
Some examples of issues with the old sandbox can be found here: http://www.slideshare.net/x00mario/an-abusive-relationship-with-angularjs http://www.slideshare.net/x00mario/an-abusive-relationship-w... The expression sandbox was not secure (and would be extremely difficult and heavily bloat the size of Angular to secure) and was not intended to be secure. It only blacklisted specific known attacks. As your link says, they removed it because people kept thinking it was a security feature they could rely on. Angular runs eval on the page DOM. This isn't secure when the page DOM is controlled by an attacker (such as a webpage trying to elevate into an extension's privileges). Angular 1.x is the wrong tool to use within page extensions.

deleted 10y ago

[deleted]

wnevets 10y ago

removing the sandbox just removes the illusion of being protected.

vladimir-y 10y ago
Correct, now it should be clear for all that Angular v1 is dangerous thing by design and it should not be used at all. Most likely a lot of not very experienced developers do for example $watch on value provided by the user input and that's a 100% XSS vulnerability since $watch does evaluate value if that was a string. And $watch is just a one example, there is a list of methods that do expressions evaluation.
- bzbarsky 10y ago
  Note that in the context of a browser extension an "XSS vulnerability" means "a web page just got to run code with the extension's privileges".... [Disclaimer: I work for Mozilla.]
  - vladimir-y 10y ago
    I guess extension's privileges means more privileges than a regular web page has (accessing file system for example?), if so then it's even more dramatic.
    - bzbarsky 10y ago
      Right. Extensions have more privileges than normal web pages. For the specific case here (webextensions), the extension asks for a list of permissions at install time, so which privileges it has, exactly, depends on the extension. https://developer.chrome.com/extensions/declare_permissions https://developer.chrome.com/extensions/declare_permissions has documentation on what the various permissions you can request are.
- codedokode 10y ago
  You are making wrong conslusions. > Angular v1 is dangerous thing by design It is not dangerous. The vulnerability appears when incompetent developer injects Angular into a web page from a browser extension in Firefox (I don't know whether it would work in other browsers because they have other extension architecture).

AgentME 10y ago

Some examples of issues with the old sandbox can be found here: http://www.slideshare.net/x00mario/an-abusive-relationship-with-angularjs http://www.slideshare.net/x00mario/an-abusive-relationship-w... The expression sandbox was not secure (and would be extremely difficult and heavily bloat the size of Angular to secure) and was not intended to be secure. It only blacklisted specific known attacks. As your link says, they removed it because people kept thinking it was a security feature they could rely on. Angular runs eval on the page DOM. This isn't secure when the page DOM is controlled by an attacker (such as a webpage trying to elevate into an extension's privileges). Angular 1.x is the wrong tool to use within page extensions.