Opened 8 years ago

Closed 10 months ago

#6152 closed enhancement (worksforme)

Remove Chrome JS direct vectors to arbitrary machine code

Reported by: mikeperry Owned by: tbb-team
Priority: Medium Milestone:
Component: Applications/Tor Browser Version:
Severity: Normal Keywords: tbb-firefox-patch
Cc: ioerror, rransom, g.koppen@…, mcs, brade Actual Points:
Parent ID: Points:
Reviewer: Sponsor:


We should consider patching Firefox to remove ways that extension-level JS can execute machine code.

Right now, this includes jsctypes, any ways there might be to load an binary XPCOM component from a DLL at runtime (these may have been removed with Firefox 4+'s new-style component registration), and maybe the ability to launch apps from JS XPCOM.

I contend this doesn't make much sense to do until we have functional sandboxes, though, because simply the ability read and write arbitrary files can be used to bootstrap arbitrary code exec eventually.

It will also break addons that try to use this functionality. Most notably, Moxie's Convergence relies on jsctypes.

However, once sandboxes are deployed, removing these features will block the ability of UXSS exploits to directly attack certain system calls. This will raise the bar for sandbox breakout for these types of bugs.

Child Tickets

Change History (8)

comment:1 Changed 8 years ago by mikeperry

FYI: For people playing along at home, --disable-ctypes is the ctypes configure switch. Any feedback on the interaction with that with stock TBB and/or other addons will be useful and helpful.

comment:2 Changed 8 years ago by gk

Cc: g.koppen@… added

comment:3 Changed 8 years ago by mcs

Cc: mcs brade added

comment:4 Changed 8 years ago by mikeperry

Priority: majornormal

Without sandboxing (#5156 and probably other tickets), we're not going to attempt this. Lowering priority to reflect that.

comment:5 Changed 6 years ago by erinn

Keywords: tbb-firefox-patch added

comment:6 Changed 6 years ago by erinn

Component: Firefox Patch IssuesTor Browser
Owner: changed from mikeperry to tbb-team

comment:7 Changed 3 years ago by teor

Severity: Normal

Set all open tickets without a severity to "Normal"

comment:8 Changed 10 months ago by gk

Resolution: worksforme
Status: newclosed

I think that's a thing that got implemented by switching to WebExtenions.

Note: See TracTickets for help on using tickets.