LWN: Comments on "Firefox locks down the components directory"

Firefox locks down the components directory

mlankhorst — Sun, 29 Nov 2009 22:26:04 +0000

Considering it checks the file components.list what would stop anyone from
'updating' that file, so their crappy plugin would still work?

Firefox locks down the components directory

njs — Sat, 28 Nov 2009 06:53:36 +0000

Sure, but IIUC chrome privileges *mean* you can do anything firefox can do, e.g. write to arbitrary files; turning this into a full-blown binary code injection is easy. JSCtypes doesn't sound like it lets you do anything you couldn't do before if you really wanted to and didn't care how much wreckage you left in your wake; it just makes it easier and supported.

Firefox locks down the components directory

bangert — Fri, 27 Nov 2009 11:33:25 +0000

except that, in the past a number of privilege escalation bugs, elevating
code to chrome:/ level, have been present in FF?

it is not a security thing

zuki — Thu, 26 Nov 2009 19:15:23 +0000

Clearly, having executables loaded automatically at application startup simply because they are located in the components directory is a security hole, particularly when they are beyond the reach of Firefox's add-on management interface...

To me this doesn't seem so clear - if something is able to write files in the directory containing the installed program, it already has taken over this user and it might just as well overwrite the whole program with a "special" version. No need to install extensions.

This does seem to be what Mike Shaver thinks (in bug #519357):
This isn't designed to protect against attacks on Firefox; that is a hard battle to win (though we do the hash check on every update, and pave over if there's a mismatch). This is to close off an extension mechanism that "happened to work"

Once you are done, you're done, so not everything is a security hole.

Firefox locks down the components directory

nix — Thu, 26 Nov 2009 14:36:11 +0000

The docs explicitly say that it only works for chrome: I haven't checked
the code to see if this is enforced, but the FF hackers aren't complete
idiots so I suspect it is, since they went so far as to document it.

Firefox locks down the components directory

roelofs — Thu, 26 Nov 2009 05:06:26 +0000

JSCtypes is a module that exposes C-compatible external library functions to JavaScript code.

On the face of it, that sounds very scary. Are we sure that it does so only for add-ons, not for embedded JS in web pages? (I don't know enough about JS in general and the specifically required Component.whatever call to be able to judge.)

Greg