Comments on: Firewall Makers vs Evil JavaScript

By: Giorgio

Giorgio — Sat, 13 Sep 2008 07:33:27 +0000

@Mook:
You’re obviously right: that’s much challenging (as I said) because you should manage to sandbox and analyze the page behaviour, isolating exploits so that they do not bring down the firewall/proxy itself (kind of virtualization?)
Also this would’t add anything to protect from in-browser attacks such as XSS and CSRF, because (unless you add some technology which you could better deploy inside the browser itself, such as NoScript, Firekeeper, CSP or the upcoming ABE) they would be successfully carried by the proxy.
My whole point (and the conclusion of the original article as I understood it) is that securing JavaScript at the semantic level is very impractical, if not impossible, and anyway a task for the browser, not for any other external device/software.

By: Mook

Mook — Sat, 13 Sep 2008 05:05:01 +0000

But if you manage to execute the script with the browser context anyway, isn’t that just like actually being in the browser? That is, you negate the security benefits by putting a different browser in front that can be exploited? Especially if it’s using the same JS engine (spidermonkey / V8)…

By: Giorgio

Giorgio — Fri, 12 Sep 2008 21:01:37 +0000

@Benjamin
ROTFL, that’s why I talked about sandboxed execution…

By: Benjamin Otte

Benjamin Otte — Fri, 12 Sep 2008 20:47:09 +0000

Here’s a program. if it inf-loops it’s evil, if it doesn’t it’s fine. Now we just need to solve the halting problem and then we can secure JS!

By: Giorgio

Giorgio — Fri, 12 Sep 2008 19:32:06 +0000

@Doron:
Caja’s scope is quite different, IMHO, trying to provide a sandboxed environment for web applications wanting to run user-generated JavaScript “safely”.

By: Doron

Doron — Fri, 12 Sep 2008 19:22:50 +0000

Google has a project called Caja (http://code.google.com/p/google-caja/) that attempts to secure javascript in webpages by rewriting it and allowing you to configure what the JS can access.

By: Giorgio

Giorgio — Fri, 12 Sep 2008 18:17:06 +0000

@Rob:
I can’t tell for sure, but I tend to agree with your polite aesthetic judgment.

By: Rob

Rob — Fri, 12 Sep 2008 18:14:11 +0000

Hey, the F5 girl is hot!
Is she Lori or a different model? :P