3 ms·

For example, the following hidden anywhere in the codebase allows arbitrary code execution even under the most stringent JavaScript security policy (no eval etc

For example, the following hidden anywhere in the codebase allows arbitrary code execution even under the most stringent JavaScript security policy (no eval etc): I=c=>c.map?c[0]?c.reduce((a,b)=>a[b=I(b)]||a(b),self):c[1]:c (How it works is an exercise to the reader) The actual code to run can be delivered as an innocuous looking JavaScript array from some server, and potentially only delivered to one high value target.

ikekkdcjkfke 11mo ago
And the reason we can’t put execution of non-declared code behind a permission is because one anal developer at chrome thinks that we shouldn’t break existing sites even though no serious site would do this and you could just show a permission popup with triangle exclamation mark
- johnebgd 11mo ago
  Users have largely been trained to click okay when asked to give permission without thinking.
- londons_explore 11mo ago
  That's what's great about this - it is an interpreter which allows the attacker to do absolutely anything, but no non-declared code is directly run.
cj 11mo ago
Isn’t minified code banned from chrome extensions?
- electroly 11mo ago
  Google allows minified extensions and doesn't require you to provide the original unminified source. I've never provided Google the real source code to my extension and they rubber-stamp every release. The Chrome Web Store is the wild west--you're on your own. Mozilla allows minification but you're required to provide the original buildable source. Mozilla actually looks at the code and they reject updates all the time.
  - cj 11mo ago
    Obfuscation is banned. Minification is not. https://blog.chromium.org/2018/10/trustworthy-chrome-extensions-by-default.html?m=1#:~:text=Existing%20extensions%20with%20obfuscated%20code%20can%20continue%20to%20submit%20updates%20over%20the%20next%2090%20days%2C%20but%20will%20be%20removed%20from%20the%20Chrome%20Web%20Store%20in%20early%20January%20if%20not%20compliant. https://blog.chromium.org/2018/10/trustworthy-chrome-extensi...
arein3 11mo ago
Let me ask gemini Wow, it deconstructed it beautifully A Concrete Example Imagine you pass this array to the function: ['alert', 'Hello World'] Here is the step-by-step execution: Initialization: The accumulator a starts as self (the window object). Iteration 1 (b = "alert"): I("alert") returns string "alert". It tries a["alert"] (which is window["alert"]). This finds the alert function. New Accumulator a: The alert function. Iteration 2 (b = "Hello World"): I("Hello World") returns string "Hello World". It tries a["Hello World"]. The alert function does not have a property named "Hello World", so this is undefined. The || operator moves to the right side: a(b). It executes alert("Hello World"). Result: A browser popup appears.

ikekkdcjkfke 11mo ago

And the reason we can’t put execution of non-declared code behind a permission is because one anal developer at chrome thinks that we shouldn’t break existing sites even though no serious site would do this and you could just show a permission popup with triangle exclamation mark

johnebgd 11mo ago
Users have largely been trained to click okay when asked to give permission without thinking.
londons_explore 11mo ago
That's what's great about this - it is an interpreter which allows the attacker to do absolutely anything, but no non-declared code is directly run.

cj 11mo ago

Isn’t minified code banned from chrome extensions?

electroly 11mo ago
Google allows minified extensions and doesn't require you to provide the original unminified source. I've never provided Google the real source code to my extension and they rubber-stamp every release. The Chrome Web Store is the wild west--you're on your own. Mozilla allows minification but you're required to provide the original buildable source. Mozilla actually looks at the code and they reject updates all the time.
- cj 11mo ago
  Obfuscation is banned. Minification is not. https://blog.chromium.org/2018/10/trustworthy-chrome-extensions-by-default.html?m=1#:~:text=Existing%20extensions%20with%20obfuscated%20code%20can%20continue%20to%20submit%20updates%20over%20the%20next%2090%20days%2C%20but%20will%20be%20removed%20from%20the%20Chrome%20Web%20Store%20in%20early%20January%20if%20not%20compliant. https://blog.chromium.org/2018/10/trustworthy-chrome-extensi...

arein3 11mo ago

Let me ask gemini Wow, it deconstructed it beautifully A Concrete Example Imagine you pass this array to the function: ['alert', 'Hello World'] Here is the step-by-step execution: Initialization: The accumulator a starts as self (the window object). Iteration 1 (b = "alert"): I("alert") returns string "alert". It tries a["alert"] (which is window["alert"]). This finds the alert function. New Accumulator a: The alert function. Iteration 2 (b = "Hello World"): I("Hello World") returns string "Hello World". It tries a["Hello World"]. The alert function does not have a property named "Hello World", so this is undefined. The || operator moves to the right side: a(b). It executes alert("Hello World"). Result: A browser popup appears.