[Wroclaw #6] Introduction to desktop browser add-ons
0 likes200 views
This document discusses browser add-ons such as themes and extensions, the moderation process for extensions, and common vulnerabilities in extensions. The moderation process involves checking metadata, acceptance criteria like functionality and permissions, and static code review. Vulnerabilities discussed include using external scripts, eval() to parse JSON, untrusted data in event handlers, innerHTML, and bugs in third party libraries. The document provides good practices for developers to avoid these vulnerabilities.
[Wroclaw #6] Introduction to desktop browser add-ons
- 1. Introduction to desktop browser add-ons. Explanation the process of moderation. Most frequent attack vectors and good practices for developers. Wojtek Zieliński
- 6. Browser extensions Background script (UI, app state, sync) Content script (context, DOM, r/w, limitations) Popups Options Speed Dials Sidebars ./manifest.json (metadata)
- 7. Moderation process 1. Check metadata: summary, description, category, service, support, source code, icons, screenshots, etc. 2. Acceptance criteria: – Must perform as described – Screenshots, description, category – Private information – Remote code execution – Obfuscation 3. Code review
- 8. Moderation process / Static code review New and upgrades Redundant files, permission, comments • Code performance • Thieving data • Proposing fix • Bad programming techniques, attacks, malware code • Cooperation Additional testing Automation
- 9. Vulnerability in extensions – External scripts (http, m-i-m) – Parsing JSON using eval() – Passing strings to setTimeout() and setInterval() – Inserting untrusted data into Event Handler – Using InnerHTML – Bugs in third party libraries jQuery – A bunch of other XSS attacks
- 10. Vulnerability in extensions / External script injection
- 11. Vulnerability in extensions / Parse JSON using eval() 1. eval(json string) 2. JSON.parse(json string) 3. eval(JS string) 4. JSON.parse(JS string)
- 12. Vulnerability in extensions / Event Handlers
- 13. Vulnerability in extensions / innerHTML
- 14. Vulnerability in extensions / data-target
- 15. Tahnk You!