Security/Reviews/Firefox9/ReviewNotes/SourceMap - Revision history

Curtisk at 19:46, 4 January 2012

2012-01-04T19:46:11Z

← Older revision		Revision as of 19:46, 4 January 2012
Line 34:		Line 34:
	* [decoder] Penetration testing for information leakage and code injection		* [decoder] Penetration testing for information leakage and code injection
	* Documentation needs to cover security implications with regards to making a source map public (MDN Doc)		* Documentation needs to cover security implications with regards to making a source map public (MDN Doc)

			[[Category:SecReview\|Sourcemap]]

Curtisk: /* Conclusions / Action Items (10-20 minutes) */

2011-08-25T19:01:35Z

Conclusions / Action Items (10-20 minutes)

← Older revision		Revision as of 19:01, 25 August 2011
Line 31:		Line 31:
	** no code running in content can access the sourcemap library, thus preventing data exfil from other locations		** no code running in content can access the sourcemap library, thus preventing data exfil from other locations

	== Conclusions / Action Items ~~(10-20 minutes)~~ ==		== Conclusions / Action Items ==
	* [decoder] Penetration testing for information leakage and code injection		* [decoder] Penetration testing for information leakage and code injection
	* Documentation needs to cover security implications with regards to making a source map public (MDN Doc)		* Documentation needs to cover security implications with regards to making a source map public (MDN Doc)

Curtisk: /* Threat Brainstorming (30-40 minutes) */

2011-08-25T19:01:20Z

Threat Brainstorming (30-40 minutes)

← Older revision		Revision as of 19:01, 25 August 2011
Line 13:		Line 13:
	* Bug tracking the integration of source maps with the webconsole: https://bugzilla.mozilla.org/show_bug.cgi?id=670002		* Bug tracking the integration of source maps with the webconsole: https://bugzilla.mozilla.org/show_bug.cgi?id=670002

	== Threat Brainstorming ~~(30-40 minutes)~~ ==		== Threat Brainstorming ==
	* Attacks using the JSON data blob		* Attacks using the JSON data blob
	** using JSON.parse		** using JSON.parse
Line 30:		Line 30:
	** there is no restriction of where the URL can be on the web		** there is no restriction of where the URL can be on the web
	** no code running in content can access the sourcemap library, thus preventing data exfil from other locations		** no code running in content can access the sourcemap library, thus preventing data exfil from other locations

	== Conclusions / Action Items (10-20 minutes) ==		== Conclusions / Action Items (10-20 minutes) ==
	* [decoder] Penetration testing for information leakage and code injection		* [decoder] Penetration testing for information leakage and code injection
	* Documentation needs to cover security implications with regards to making a source map public (MDN Doc)		* Documentation needs to cover security implications with regards to making a source map public (MDN Doc)

Curtisk at 19:00, 25 August 2011

2011-08-25T19:00:04Z

← Older revision		Revision as of 19:00, 25 August 2011
Line 13:		Line 13:
	* Bug tracking the integration of source maps with the webconsole: https://bugzilla.mozilla.org/show_bug.cgi?id=670002		* Bug tracking the integration of source maps with the webconsole: https://bugzilla.mozilla.org/show_bug.cgi?id=670002

	~~= Goal of Feature, what is trying to be achieved (problem solved, use cases, etc) =~~
	~~= What solutions/approaches were considered other than the proposed solution? =~~
	~~= Why was this solution chosen? =~~
	~~= Any security threats already considered in the design and why? =~~
	== Threat Brainstorming (30-40 minutes) ==		== Threat Brainstorming (30-40 minutes) ==
	* Attacks using the JSON data blob		* Attacks using the JSON data blob

Curtisk: /* Introduce Feature (5-10 minutes) */

2011-08-25T18:58:48Z

Introduce Feature (5-10 minutes)

← Older revision		Revision as of 18:58, 25 August 2011
Line 2:		Line 2:
	SourceMap - https://wiki.mozilla.org/DevTools/Features/SourceMap		SourceMap - https://wiki.mozilla.org/DevTools/Features/SourceMap
	Agenda:		Agenda:
	== Introduce Feature ~~(5-10 minutes)~~ ==		== Introduce Feature ==
	The premise of the project is that most JavaScript goes through some type of compilation step before being deployed. Generally, that compilation step is minification, but increasingly it is also cross language compilation steps like CoffeeScript, ParenScript, or Google Web Toolkit. In both both cases, you have your original source(s) that you wrote, and then the generated source which is produced in an automated fashion by some compilation step. When there is a bug or uncaught exception in the generated source, it is a pain to debug because you are not familiar with that code because you didn't write it yourself. Source maps come in to save the day by mapping a generated line and column information back to the original source(s), original line, and original column. It is a JSON file, with the actual mappings encoded in a base 64 variant. Developer tools can then take advantage of the presence of these source map files by displaying the original position of things like logged messages and uncaught errors, or by allowing developers to set break points in their original sources rather than the generated ones as they step through a script's execution in the debugger.		The premise of the project is that most JavaScript goes through some type of compilation step before being deployed. Generally, that compilation step is minification, but increasingly it is also cross language compilation steps like CoffeeScript, ParenScript, or Google Web Toolkit. In both both cases, you have your original source(s) that you wrote, and then the generated source which is produced in an automated fashion by some compilation step. When there is a bug or uncaught exception in the generated source, it is a pain to debug because you are not familiar with that code because you didn't write it yourself. Source maps come in to save the day by mapping a generated line and column information back to the original source(s), original line, and original column. It is a JSON file, with the actual mappings encoded in a base 64 variant. Developer tools can then take advantage of the presence of these source map files by displaying the original position of things like logged messages and uncaught errors, or by allowing developers to set break points in their original sources rather than the generated ones as they step through a script's execution in the debugger.
	There is a core library which will be shared across developer tools in Firefox, compiler tools generating source maps, and even non-Firefox developer tools. It only deals with the source maps directly, and knows nothing about where they came from, how to get them, where to put them, etc. This work is pretty much complete, although there are some minor licensing issues that need to be dealt with before it can land.		There is a core library which will be shared across developer tools in Firefox, compiler tools generating source maps, and even non-Firefox developer tools. It only deals with the source maps directly, and knows nothing about where they came from, how to get them, where to put them, etc. This work is pretty much complete, although there are some minor licensing issues that need to be dealt with before it can land.
Line 12:		Line 12:
	* Bug tracking adding the core lib to Firefox as a jsm: https://bugzilla.mozilla.org/show_bug.cgi?id=669999		* Bug tracking adding the core lib to Firefox as a jsm: https://bugzilla.mozilla.org/show_bug.cgi?id=669999
	* Bug tracking the integration of source maps with the webconsole: https://bugzilla.mozilla.org/show_bug.cgi?id=670002		* Bug tracking the integration of source maps with the webconsole: https://bugzilla.mozilla.org/show_bug.cgi?id=670002

	= Goal of Feature, what is trying to be achieved (problem solved, use cases, etc) =		= Goal of Feature, what is trying to be achieved (problem solved, use cases, etc) =
	= What solutions/approaches were considered other than the proposed solution? =		= What solutions/approaches were considered other than the proposed solution? =

Curtisk: Created page with "Items to be reviewed: SourceMap - https://wiki.mozilla.org/DevTools/Features/SourceMap Agenda: == Introduce Feature (5-10 minutes) == The premise of the project is that most ..."

2011-08-25T18:57:38Z

Created page with "Items to be reviewed: SourceMap - https://wiki.mozilla.org/DevTools/Features/SourceMap Agenda: == Introduce Feature (5-10 minutes) == The premise of the project is that most ..."

New page

Items to be reviewed:
SourceMap - https://wiki.mozilla.org/DevTools/Features/SourceMap
Agenda:
== Introduce Feature (5-10 minutes) ==
The premise of the project is that most JavaScript goes through some type of compilation step before being deployed. Generally, that compilation step is minification, but increasingly it is also cross language compilation steps like CoffeeScript, ParenScript, or Google Web Toolkit. In both both cases, you have your original source(s) that you wrote, and then the generated source which is produced in an automated fashion by some compilation step. When there is a bug or uncaught exception in the generated source, it is a pain to debug because you are not familiar with that code because you didn't write it yourself. Source maps come in to save the day by mapping a generated line and column information back to the original source(s), original line, and original column. It is a JSON file, with the actual mappings encoded in a base 64 variant. Developer tools can then take advantage of the presence of these source map files by displaying the original position of things like logged messages and uncaught errors, or by allowing developers to set break points in their original sources rather than the generated ones as they step through a script's execution in the debugger.
There is a core library which will be shared across developer tools in Firefox, compiler tools generating source maps, and even non-Firefox developer tools. It only deals with the source maps directly, and knows nothing about where they came from, how to get them, where to put them, etc. This work is pretty much complete, although there are some minor licensing issues that need to be dealt with before it can land.
The first developer tool in Firefox which will take advantage of source maps is the webconsole. It will map logged messages and uncaught errors back to their original sources. This work is in progress and the bulk of it is done, but there are a few patches that need to land that this work is dependent upon.
Here are some links with more information:
* Feature page (has mockups of the UI for the webconsole integration that I implemented): https://wiki.mozilla.org/DevTools/Features/SourceMap
* Source map format specification: https://docs.google.com/document/d/1U1RGAehQwRypUTovF1KRlpiOFze0b-_2gc6fAH0KY0k/edit?pli=1
* Core lib for parsing and generating source maps: https://github.com/mozilla/source-map
* Bug tracking adding the core lib to Firefox as a jsm: https://bugzilla.mozilla.org/show_bug.cgi?id=669999
* Bug tracking the integration of source maps with the webconsole: https://bugzilla.mozilla.org/show_bug.cgi?id=670002
= Goal of Feature, what is trying to be achieved (problem solved, use cases, etc) =
= What solutions/approaches were considered other than the proposed solution? =
= Why was this solution chosen? =
= Any security threats already considered in the design and why? =
== Threat Brainstorming (30-40 minutes) ==
* Attacks using the JSON data blob
** using JSON.parse
** restricted to basic types, non-functions
** I don't see any problems regarding JSON itself, if it is parsed by the JS functionality. Any such attack could be conducted directly through JS as well.
** Attacks on binary blob format inside the JSON blob
*** Not a problem if the interpreting code is JS itself, but future implementations might want to use C for perf reasons. In that case, another review will be required.
* Code is running with Chrome Privileges
** Does the code take any actions based on the source map information that could be useful?
*** File/URL specification in the format? Allows local files and other protocols
**** Can any information (file content, presence of files) leak back to the content (cross zones)?
***** Timing attacks?
*** SourceMap code needs to whitelist http/https (preferably) as the only allowed schemes when loading source maps and source files. Second best would be calling CheckLoadURIWithPrincipal() with the original documents principal. Otherwise you allow javascript:<evilcode> in a Chrome context, or can call custom add-on protocols (make toll Skype calls? Send IM's?).
* source file names, what are they used for
** used if genereated file is made of multiple files to find the true source
** there is no restriction of where the URL can be on the web
** no code running in content can access the sourcemap library, thus preventing data exfil from other locations
== Conclusions / Action Items (10-20 minutes) ==
* [decoder] Penetration testing for information leakage and code injection
* Documentation needs to cover security implications with regards to making a source map public (MDN Doc)