4 ms·
At Mozilla (and this was 10 years ago), you couldn't minify or modify any library. (There were ways to include binaries, but it was complicated.) In this case,
by gkoberger 6y ago
At Mozilla (and this was 10 years ago), you couldn't minify or modify any library. (There were ways to include binaries, but it was complicated.)
In this case, they flagged a pattern of unicode that Google felt nobody with good intentions would be using. Turns out, Lodash used that string for something, hence the blocking. It had nothing to do with obfuscation, but rather a good-faith attempt to block bad things.
Similar to how you might trigger heavy ratelimits on a request like `wp-admin/index.php`, since it's clearly a bot trying to find vulnerabilities.
- Dylan16807 6y ago> a string that Google felt nobody with good intentions would be using It looks like it triggered on text having too much entropy, which is really reckless on such short sequences. If there's no specific thing it's trying to block, there's less good faith to give credit for.
- gkoberger 6y agoWell, we don't know what happened behind the scenes. Based on the fact that they took down an extension that hadn't been updated in a month, it makes me think a serious vulnerability was discovered behind the scenes in other extensions.
- Dylan16807 6y agoKeep in mind that it triggered on three separate strings. The chance of them all being malware/vulnerability signatures seems pretty low, unless their method for generating those is particularly reckless.