3 ms·

> One fundamental aspect of E they brought over in ECMAScript 5 was support for the object-capability security model, he said. .... The provider of the object c

> One fundamental aspect of E they brought over in ECMAScript 5 was support for the object-capability security model, he said. .... The provider of the object can populate it with methods that capture internal state variables and can encapsulate that state, so the clients of the object cannot tamper with it. By “freezing,” what’s meant is that the properties of the object can no longer be changed, he added. Calling this "security" is hopefully not serious. "the properties of the object can no longer be changed" yes, unless someone else just unfreezes the object. > That step addressed a security problem: prototype poisoning, in which objects created in traditional JavaScript were all mutable and can be subverted to confuse or surveil other parts of a program by anyone who had access to them. This is still a problem, and the "harden" function that is described doesn't actually help because the things that it relies on could be poisoned. From a practical security perspective, none of this actually accomplished anything or protects against any kind of bad actor doing something nefarious. I guess it's maybe useful as a comparison to E, but this article could have been a lot more direct and a lot less "we once did some stuff that is academically interesting in JavaScript."

naasking 4y ago
Sorry, how do you unfreeze a frozen object? Only references I see online involve cloning it, which preserves the security properties of a frozen object. As for harden(), whether its vulnerable to it's prototype chain in the way you describe depends entirely on how it's written. That said, these aren't amateurs so I expect they know what they're doing, and transitively freezing an object graph does add important security properties.
etc_passwd 4y ago
The security principle is largely based on OCAP-based permission scheme, where implicit access to an object is equal to the right to access, and freezing said object limits its use.
deleted 4y ago
[deleted]
ShredKazoo 4y ago
>"the properties of the object can no longer be changed" yes, unless someone else just unfreezes the object. There doesn't appear to be any unfreeze method. >This is still a problem, and the "harden" function that is described doesn't actually help because the things that it relies on could be poisoned. I think the threat model here is untrusted code which runs after the "harden" function completes. (I think this article would've been better if it had discussed threat models at the beginning.)

naasking 4y ago

Sorry, how do you unfreeze a frozen object? Only references I see online involve cloning it, which preserves the security properties of a frozen object. As for harden(), whether its vulnerable to it's prototype chain in the way you describe depends entirely on how it's written. That said, these aren't amateurs so I expect they know what they're doing, and transitively freezing an object graph does add important security properties.

etc_passwd 4y ago

The security principle is largely based on OCAP-based permission scheme, where implicit access to an object is equal to the right to access, and freezing said object limits its use.

deleted 4y ago

[deleted]

ShredKazoo 4y ago

>"the properties of the object can no longer be changed" yes, unless someone else just unfreezes the object. There doesn't appear to be any unfreeze method. >This is still a problem, and the "harden" function that is described doesn't actually help because the things that it relies on could be poisoned. I think the threat model here is untrusted code which runs after the "harden" function completes. (I think this article would've been better if it had discussed threat models at the beginning.)