Security/Features: Difference between revisions

From MozillaWiki
Jump to navigation Jump to search
No edit summary
 
(45 intermediate revisions by 4 users not shown)
Line 1: Line 1:
This page lists the security features under development and our plans for deployment.
{{warning|This page is no longer maintained.  Please see [[SecurityEngineering/Roadmap]] for current projects}}
 
This page once listed the security features under development and our plans for deployment.


= Status Overview =
= Status Overview =


{|class="fullwidth-table sortable" border
<table class="fullwidth-table sortable" border>
| '''Feature'''  
<tr>
| '''Goals'''  
<th> Feature </th>
| '''Design'''  
<th> Design </th>
| '''Discussion'''  
<th> Discussion </th>
| '''Review & Standards'''
<th> Review & Standards </th>
| '''Prototype'''  
<th> Prototype  </th>
| '''Implementation'''
<th> Implementation </th>
|-
<th> Version Target </th>
| Sec-From
</tr>
| Done
<tr>
| Done
<td style='background-color:;'> Origin </td>
| In Progress
<td style='background-color:#cfc;'> Done </td>
|
<td style='background-color:#cfc;'> Done </td>
|
<td style='background-color:#ffc;'> In Progress</td>
|-
<td style='background-color:#fcc;'>Not Started </td>
| CSP
<td style='background-color:#fcc;'>Not Started</td>
| Done (2/2009)
<td style='background-color:#fcc;'>  </td>
| Done (5/2009)
</tr>
| In Progress
<tr>
|
<td style='background-color:;'> [[Security/CSP|CSP]] </td>
| In Progress
<td style='background-color:#cfc;'> Done (2/2009)</td>
| In Progress
<td style='background-color:#dfc;'> Pretty Much Done (9/2009)</td>
|-
<td style='background-color:#fcc;'> Not Started</td>
| ForceTLS
<td style='background-color:#cfc;'> Done (8/2008)</td>
| Done
<td style='background-color:#cfc;'> [http://hg.mozilla.org/mozilla-central/rev/7229621a1886 Done] (3/2010)</td>
| In Progress
<td style='background-color:#cfc;'> 4.0 </td>
| Done (5/2009)
</tr>
|
<tr>
| Done (6/2009)
<td style='background-color:;'> [https://bugzilla.mozilla.org/show_bug.cgi?id=495115 ForceTLS] </td>
| In Progress
<td style='background-color:#cfc;'> Done (Q2 2009)</td>
|-
<td style='background-color:#ffc;'> In Progress</td>
| Process Isolation
<td style='background-color:#ffc;'> [http://tools.ietf.org/html/draft-hodges-strict-transport-sec In Progress]</td>
| Done
<td style='background-color:#cfc;'> Done (8/2010)</td>
| In Progress
<td style='background-color:#cfc;'> [http://hg.mozilla.org/mozilla-central/rev/5dc3c2d2dd4f Done] (8/2009)</td>
| In Progress
<td style='background-color:#cfc;'> 4.0 </td>
|
</tr>
| In Progress
<tr>
|
<td style='background-color:;'> [[Security/ProcessIsolation|Process Isolation]] </td>
|}
<td style='background-color:#cfc;'> Done</td>
<td style='background-color:#ffc;'> In Progress</td>
<td style='background-color:;'>&nbsp;</td>
<td style='background-color:#eee;'> n/a </td>
<td style='background-color:#ffc;'> In Progress</td>
<td style='background-color:#ffc;'> ? </td>
</tr>
<tr>
<td style='background-color:;'> X-Frame-Options</td>
<td style='background-color:#cfc;'> Done (Previous)</td>
<td style='background-color:#ffc;'> In Progress (stable)</td>
<td style='background-color:#cfc;'> Done (Previous)</td>
<td style='background-color:#eee;'> n/a </td>
<td style='background-color:#cfc;'> [https://bugzilla.mozilla.org/show_bug.cgi?id=475530 Done]</td>
<td style='background-color:#cfc;'> 4.0 </td>
</tr>
<tr>
<td style='background-color:;'> [[Security/Features/Content Hashing|Content Hashing]]</td>
<td style='background-color:#ffc;'> in progress</td>
<td style='background-color:#ffc;'> in progress </td>
<td style='background-color:#fcc;'> tbd </td>
<td style='background-color:#fcc;'> tbd </td>
<td style='background-color:#fcc;'> tbd </td>
<td style='background-color:#fcc;'> ? </td>
</tr>
<tr>
<td style='background-color:;'> [[Security/Features/XSS Filter|XSS Filter]]</td>
<td style='background-color:#ffc;'> in progress</td>
<td style='background-color:#ffc;'> in progress </td>
<td style='background-color:#fcc;'> tbd </td>
<td style='background-color:#fcc;'> tbd </td>
<td style='background-color:#fcc;'> tbd </td>
<td style='background-color:#fcc;'> ? </td>
</tr>
 
</table>


= Projects =
= Projects =
This is intended to summarize the status and basic goals of each project, and not serve as an ultimate authority on each of the features.   
This is intended to summarize the status and basic goals of each project, and not serve as an ultimate authority on each of the features.   
SEE ALSO: [[Privacy/Features/]]
== Origin Header / Sec-From ==
== Origin Header / Sec-From ==
Beginning as an [[Security/Origin]] header that aimed to prevent clickjacking as well as CSRF and JSON data theft, this feature has evolved into [[Security/Sec-From]] that will not prevent clickjacking, but can be compatible with various other specifications for similar HTTP request headers.
Beginning as an [[Security/Origin]] header that aimed to prevent clickjacking as well as CSRF and JSON data theft, this feature has evolved into [[Security/Sec-From]] that will not prevent clickjacking, but can be compatible with various other specifications for similar HTTP request headers.


'''Design''': Done (6/18/2009)
'''Design''': Done (6/18/2009)
Discussion over the behavior and uses of Sec-From has been ongoing.


Discussion over the behavior and uses of Sec-From has been ongoing, but has merged with the Internet Draft spec proposed by Adam Barth et. al [http://webblaze.cs.berkeley.edu/2009/origin/origin.txt].
Tasks:
* {{done|Write up an informal spec}} [[Security/Origin]]
* {{done|Unify spec with Adam Barth's Internet Draft}} [http://webblaze.cs.berkeley.edu/2009/origin/origin.txt].
* {{done|Unify with CORS "Origin" or pick a new header name to avoid incompatibility.}}  <strike>Reworked as [[Security/Sec-From]].</strike>


Header is also mentioned in HTML 5 [http://www.w3.org/TR/cors/#origin-header].
Such an "Origin" header is also mentioned in HTML 5 [http://www.w3.org/TR/cors/#origin-header].


''Goals'':
''Goals'':
Line 67: Line 111:


; http://lists.w3.org/Archives/Public/public-webapps/2009JanMar/0057.html : discussion about renaming from "Origin"
; http://lists.w3.org/Archives/Public/public-webapps/2009JanMar/0057.html : discussion about renaming from "Origin"
Tasks:
* {{done|Settle on a design.}} [[Security/Sec-From]]
* {{ok|Initiate public discussion on newsgroups and other public forums}}




'''Review and Standardization''': In Progress.  ETA: ?
'''Review and Standardization''': In Progress.  ETA: ?
Tasks:
* {{done|Find appropriate standards body to review this feature}} (IETF).
* {{done|Submit to standards body.}}  (Adam is leading this)


'''Prototype''': Not Started.  ETA: Q4 2009
'''Prototype''': Not Started.  ETA: Q4 2009
Tasks:
* {{ok|create add-on that appropriately serves this header.}}
* {{ok|create test suite that verifies values and presence of the header.}}


'''Implementation''': Not Started.  ETA: ?
'''Implementation''': Not Started.  ETA: ?
Tasks:
* {{ok|patch mozilla-central}}
* {{ok|convert prototype test suite to automated tests}}


== Content Security Policy ==
== Content Security Policy ==
Line 89: Line 150:
* Mitigate Packet Sniffing Attacks  
* Mitigate Packet Sniffing Attacks  
* Backward Compatibility with sites not employing CSP
* Backward Compatibility with sites not employing CSP
Tasks:
* {{done|create specification}} [[Security/CSP/Spec]]
* {{ok|write up example use cases}}


'''Discussion''': In Progress.
'''Discussion''': In Progress.


Public discussion of the CSP design and specification has taken place in [http://groups.google.com/group/mozilla.dev.security mozilla.dev.security].  CSP is generally discussed as a good idea, and the discussion has evolved into a compatibility, deployment and small edge-case discussion.   
Public discussion of the CSP design and specification has taken place in [http://groups.google.com/group/mozilla.dev.security mozilla.dev.security].  CSP is generally discussed as a good idea, and the discussion has evolved into a compatibility, deployment and small edge-case discussion.   
Tasks:
* {{done|discuss [[Security/CSP/Spec]] spec in public forums}}
* {{done|get feedback (rinse, repeat) until comments are trivial}}
* {{done|come to decision about whether or not to support meta tags (not supporting)}}
* {{done|come to decision about whether or not to support multiple HTTP headers}}


'''Review and Standardization''': In Progress.  ETA: ?
'''Review and Standardization''': In Progress.  ETA: ?


Appropriate paths for standardization and external review are being explored.
Appropriate paths for standardization and external review are being explored.
Tasks:
* {{ok|find a standards body that should review CSP}}
* {{ok|submit formal spec for review/feedback}}


'''Prototype''': Done.  (8/2008)
'''Prototype''': Done.  (8/2008)


[http://people.mozilla.org/~bsterne/content-security-policy/download.html Prototype implementation] was completed in August 2008.  It implements an old version of CSP and does not provide the base restrictions.
[http://people.mozilla.org/~bsterne/content-security-policy/download.html Prototype implementation] was completed in August 2008.  It implements an old version of CSP and does not provide the base restrictions.
Tasks:
* {{done|create add-on that enforces policies (minus base restrictions)}}




'''Implementation''': In Progress.  ETA: Q3 2009
'''Implementation''': In Progress.  ETA: Q3 2009
CSP [[Security/CSP/Spec|as specified]] is being implemented on mozilla-central and is aimed for landing in Q3 2009.  It can be followed in {{bug|493857}}.
CSP [[Security/CSP/Spec|as specified]] is being implemented on mozilla-central and is aimed for landing in Q3 2009.  It can be followed in {{bug|493857}}.


== ForceTLS ==
Tasks:
* {{done|make patch to parse CSP policy in headers}}
* {{done|make patch to enforce CSP policy directives}}
* {{done|make patch to report policy violations}}
* {{done|make patch to implement base restriction enforcements}}
* {{done|land patch on trunk}}
* {{ok|create document explaining how to write a good policy}}
* {{ok|create document explaining how to convert a site to support CSP}}
* {{done|create server-based test suite (for other UAs who implement CSP)}}
 
== ForceTLS / Strict-Transport-Security ==
 
'''Design''': Done (6/18/2009) http://forcetls.sidstamm.com/


'''Design''': Done (6/18/2009)
Tasks:
* {{done|spec out syntax}} -- JeffH drove this


''Goals''
''Goals''


'''Discussion''': ?
* Allow sites to "default" to HTTPS
* Help prevent MITM due to HTTPS stripping (re-serving sites as HTTP instead of HTTPS).
 
'''Discussion''': In Progress.
 
The topic is pretty much simple and the edge cases have mostly been taken care of.  Any remaining issues will be exposed in the standardization process.
 
Tasks:
* {{done|lead internal discussion about use/feature set}} -- JeffH drove this
* {{ok|discuss in a public forum}}
 
 
'''Review and Standardization''': In Progress. See [[Security/STS|Strict Transport Security]] for details.
 
Tasks:
* {{ok|[http://tools.ietf.org/html/draft-hodges-strict-transport-sec IETF]}}
* <s>{{ok|W3C?}}  (Currently submitted here by Paypal)</s>
 
'''Prototype''': Done.  (6/2009)
 
https://addons.mozilla.org/en-US/firefox/addon/12714


'''Review and Standardization''': In Progress.  ETA: ?
Tasks:
* {{done|implement with tree-based host searching and SQLite client-side data storage}}
* {{done|write up summary of how to use the add-on}}
* {{done|submit to AMO for screening and public dissemination}}


'''Prototype''': Not Started.  ETA: Q4 2009
'''Implementation''': Done.  (8/2010)


'''Implementation''': Not Started. ETA: ?
Tasks:
* {{done|convert prototype to C++}} -- partially in JS, see {{bug|495115}}
* {{done|pick optimal location to scan for header}}
* {{done|write unit tests}}
* {{done|[http://hg.mozilla.org/mozilla-central/rev/5dc3c2d2dd4f land] on trunk}}


== Process Isolation ==
== Process Isolation ==


'''Design''': Done (6/18/2009)
'''Design''': In Process.
 
https://wiki.mozilla.org/Electrolysis
 
''Goals''
* Create infrastructure to allow process separation within Firefox
* Put plugins in a separate process for stability reasons
* Create separate content processes for stability and performance reasons
* Implemented isolated processes to reduce the damage for various types of vulnerabilities
 
''Tasks''
* {{done|[[Electrolysis#Phase_I:_Bootstrap|Phase 1 (bootstrap)]]}}
* {{done|[[IPC_Protocols]] design}}
* {{ok|}}[https://bugzilla.mozilla.org/showdependencytree.cgi?id=OOPP&hide_resolved=1 Out of process plugins]
* {{ok|}}[https://wiki.mozilla.org/Electrolysis#Fennec_OOP-Tabs_Phase_II_.28In_process.29 Multi-process tabs]
* {{ok|[[Electrolysis#Fennec_OOP-Tabs_Phase_III:_extensions.2Fcompatibility.2Fperformance|Phase 3 (Extensions, Compatibility and Performance)]]}}
* {{ok|[[Electrolysis#Phase_IV:_Multiple_content_processes|Phase 4 (Multiple content processes)]]}}
 
 
'''Discussion''': In Process.
 
''tasks''
* {{done|Set up IRC channel and newsgroup locations for communication on this feature.}} [[Electrolysis#Communication]]
* {{done|Develop [[Security/ProcessIsolation/ThreatModel|threat model]]}}
 
'''Review and Standardization''':
* IPD: https://wiki.mozilla.org/IPDL
* Pepper API could allow for sandboxed plugins: https://wiki.mozilla.org/Plugins:PlatformIndependentNPAPI
 
'''Prototype''': In Process.
* [[Content_Processes/Build|Build Instructions for Prototype]]
 
'''Implementation''':
 
''Phases''
https://wiki.mozilla.org/Electrolysis#Implementation
* Plugin process separation - due to ship in Lorentz
* Out of process tabs - in process
* Add-on multi-process support and compatibility
* Performance, caching, process pools
* Sandboxing, of content processes and hopefully plugins
 
== <tt>X-Frame-Options</tt> ==
 
'''Design''': Done.


''Goals''
''Goals''
* Allow sites to specify how they may be enframed
* Help prevent Clickjacking
* Be compatible with IE/WebKit implementations
'''Discussion''': In Process.
''tasks''
* {{drop|Discuss extensions of XFO with other implementation bodies}} (e.g., whole-tree-walking, etc.)
* {{done|Make sure this will work along side [Security/CSP]}}
'''Review and Standardization''':


'''Discussion''': ?
There does not exist a formal specification.  Eric Lawrence's [http://blogs.msdn.com/ie/archive/2009/01/27/ie8-security-part-vii-clickjacking-defenses.aspx blog post on X-Frame-Options] serves as the closest thing to a spec.


'''Review and Standardization''': In Progress. ETA: ?
'''Prototype''': None.


'''Prototype''': Not Started. ETA: Q4 2009
'''Implementation''':  Done (see [https://bugzilla.mozilla.org/show_bug.cgi?id=475530 bug 4755300]).


'''Implementation''': Not Started.  ETA: ?
''Tasks''
* {{done|Design Behavior}}
* {{done|Implement Patch}}
* {{done|Implement Unit Tests}}
* {{done|Get reviewed and land on trunk}}

Latest revision as of 18:43, 10 January 2014

Warning signWarning: This page is no longer maintained. Please see SecurityEngineering/Roadmap for current projects

This page once listed the security features under development and our plans for deployment.

Status Overview

Feature Design Discussion Review & Standards Prototype Implementation Version Target
Origin Done Done In Progress Not Started Not Started
CSP Done (2/2009) Pretty Much Done (9/2009) Not Started Done (8/2008) Done (3/2010) 4.0
ForceTLS Done (Q2 2009) In Progress In Progress Done (8/2010) Done (8/2009) 4.0
Process Isolation Done In Progress   n/a In Progress  ?
X-Frame-Options Done (Previous) In Progress (stable) Done (Previous) n/a Done 4.0
Content Hashing in progress in progress tbd tbd tbd  ?
XSS Filter in progress in progress tbd tbd tbd  ?

Projects

This is intended to summarize the status and basic goals of each project, and not serve as an ultimate authority on each of the features.

SEE ALSO: Privacy/Features/

Origin Header / Sec-From

Beginning as an Security/Origin header that aimed to prevent clickjacking as well as CSRF and JSON data theft, this feature has evolved into Security/Sec-From that will not prevent clickjacking, but can be compatible with various other specifications for similar HTTP request headers.

Design: Done (6/18/2009) Discussion over the behavior and uses of Sec-From has been ongoing.

Tasks:

  • [DONE] Write up an informal spec Security/Origin
  • [DONE] Unify spec with Adam Barth's Internet Draft [1].
  • [DONE] Unify with CORS "Origin" or pick a new header name to avoid incompatibility. Reworked as Security/Sec-From.

Such an "Origin" header is also mentioned in HTML 5 [2].

Goals:

  • Provide a reliably present "referrer" that
    • has minimal potential for privacy leak
    • reflects all redirects participating in the request
  • aid in detecting CSRF attempts
  • aid in preventing JSON data theft

Discussion: In Progress

We've synced up with Adam Barth and settled on a design. He is working with the CORS folks to see if his proposal can be unified with the Origin header they send.

http://lists.w3.org/Archives/Public/public-webapps/2009JanMar/0057.html
discussion about renaming from "Origin"

Tasks:

  • [DONE] Settle on a design. Security/Sec-From
  • [ON TRACK] Initiate public discussion on newsgroups and other public forums


Review and Standardization: In Progress. ETA: ?

Tasks:

  • [DONE] Find appropriate standards body to review this feature (IETF).
  • [DONE] Submit to standards body. (Adam is leading this)


Prototype: Not Started. ETA: Q4 2009

Tasks:

  • [ON TRACK] create add-on that appropriately serves this header.
  • [ON TRACK] create test suite that verifies values and presence of the header.

Implementation: Not Started. ETA: ?

Tasks:

  • [ON TRACK] patch mozilla-central
  • [ON TRACK] convert prototype test suite to automated tests

Content Security Policy

Design: In Progress. ETA: Q3 2009

Content Security Policy is intended to mitigate a large class of Web Application Vulnerabilities including Cross Site Scripting.

The CSP spec has been iterated upon many times and is approaching a stable configuration.

Goals

  • (Primary) Mitigate Cross Site Scripting (XSS)
  • Mitigate Clickjacking
  • Mitigate Packet Sniffing Attacks
  • Backward Compatibility with sites not employing CSP

Tasks:

Discussion: In Progress.

Public discussion of the CSP design and specification has taken place in mozilla.dev.security. CSP is generally discussed as a good idea, and the discussion has evolved into a compatibility, deployment and small edge-case discussion.

Tasks:

  • [DONE] discuss Security/CSP/Spec spec in public forums
  • [DONE] get feedback (rinse, repeat) until comments are trivial
  • [DONE] come to decision about whether or not to support meta tags (not supporting)
  • [DONE] come to decision about whether or not to support multiple HTTP headers

Review and Standardization: In Progress. ETA: ?

Appropriate paths for standardization and external review are being explored.

Tasks:

  • [ON TRACK] find a standards body that should review CSP
  • [ON TRACK] submit formal spec for review/feedback

Prototype: Done. (8/2008)

Prototype implementation was completed in August 2008. It implements an old version of CSP and does not provide the base restrictions.

Tasks:

  • [DONE] create add-on that enforces policies (minus base restrictions)


Implementation: In Progress. ETA: Q3 2009

CSP as specified is being implemented on mozilla-central and is aimed for landing in Q3 2009. It can be followed in bug 493857.

Tasks:

  • [DONE] make patch to parse CSP policy in headers
  • [DONE] make patch to enforce CSP policy directives
  • [DONE] make patch to report policy violations
  • [DONE] make patch to implement base restriction enforcements
  • [DONE] land patch on trunk
  • [ON TRACK] create document explaining how to write a good policy
  • [ON TRACK] create document explaining how to convert a site to support CSP
  • [DONE] create server-based test suite (for other UAs who implement CSP)

ForceTLS / Strict-Transport-Security

Design: Done (6/18/2009) http://forcetls.sidstamm.com/

Tasks:

  • [DONE] spec out syntax -- JeffH drove this

Goals

  • Allow sites to "default" to HTTPS
  • Help prevent MITM due to HTTPS stripping (re-serving sites as HTTP instead of HTTPS).

Discussion: In Progress.

The topic is pretty much simple and the edge cases have mostly been taken care of. Any remaining issues will be exposed in the standardization process.

Tasks:

  • [DONE] lead internal discussion about use/feature set -- JeffH drove this
  • [ON TRACK] discuss in a public forum


Review and Standardization: In Progress. See Strict Transport Security for details.

Tasks:

  • [ON TRACK] IETF
  • [ON TRACK] W3C? (Currently submitted here by Paypal)

Prototype: Done. (6/2009)

https://addons.mozilla.org/en-US/firefox/addon/12714

Tasks:

  • [DONE] implement with tree-based host searching and SQLite client-side data storage
  • [DONE] write up summary of how to use the add-on
  • [DONE] submit to AMO for screening and public dissemination

Implementation: Done. (8/2010)

Tasks:

  • [DONE] convert prototype to C++ -- partially in JS, see bug 495115
  • [DONE] pick optimal location to scan for header
  • [DONE] write unit tests
  • [DONE] land on trunk

Process Isolation

Design: In Process.

https://wiki.mozilla.org/Electrolysis

Goals

  • Create infrastructure to allow process separation within Firefox
  • Put plugins in a separate process for stability reasons
  • Create separate content processes for stability and performance reasons
  • Implemented isolated processes to reduce the damage for various types of vulnerabilities

Tasks


Discussion: In Process.

tasks

Review and Standardization:

Prototype: In Process.

Implementation:

Phases https://wiki.mozilla.org/Electrolysis#Implementation

  • Plugin process separation - due to ship in Lorentz
  • Out of process tabs - in process
  • Add-on multi-process support and compatibility
  • Performance, caching, process pools
  • Sandboxing, of content processes and hopefully plugins

X-Frame-Options

Design: Done.

Goals

  • Allow sites to specify how they may be enframed
  • Help prevent Clickjacking
  • Be compatible with IE/WebKit implementations

Discussion: In Process.

tasks

  • [DROPPED] Discuss extensions of XFO with other implementation bodies (e.g., whole-tree-walking, etc.)
  • [DONE] Make sure this will work along side [Security/CSP]

Review and Standardization:

There does not exist a formal specification. Eric Lawrence's blog post on X-Frame-Options serves as the closest thing to a spec.

Prototype: None.

Implementation: Done (see bug 4755300).

Tasks

  • [DONE] Design Behavior
  • [DONE] Implement Patch
  • [DONE] Implement Unit Tests
  • [DONE] Get reviewed and land on trunk
Retrieved from "https://wiki.mozilla.org/index.php?title=Security/Features&oldid=879339"