Index Accessors Security Discussion

[natashenka]

Array index accessors have led to many security issues (see: https://docs.google.com/presentation/d/11fkQeEisoszNGF8SrautVT1ltSnsQBWRxJ4usoc-g_o/edit#slide=id.g2b34aaab4a_1_0). Unfortunately, the usage metrics on those slides turned out to be measured incorrectly, real usage is here: https://www.chromestatus.com/metrics/feature/timeline/popularity/2238 . The usage is actually very high, almost 5% of all pages. Most of this usage is because jQuery uses this feature. I think there are a few options to lessen the security impact here, especially:

• Provide implementer guidance to be careful of index accessors in every new (and possibly existing) functions that handle array
• Create new features involving arrays so that they don't trigger accessors (for example, make Array.flatten intentionally only handle own data properties of an Array). It might also be possible to do this with existing features with implementation inconsistencies.
• Try to move jQuery off of this feature and then deprecate it. It's probably too late for this though ...

[caridy]

@natashenka we have been debating this problem and potential mitigation strategies during the SES weekly meeting. We plan to discuss it in more details next Thursday, it will be great if you can join us. /cc @erights

[natashenka]

Sure, let me know where and when and I'll see if I can make it. You can email me at natashenka@google.com

[caridy]

@natashenka invited sent for next thursday.

[evilpie]

Do you have data for Firefox? I asked around and we don't think that indexed accessors are causing especially many security issues for us. I think I remember some issues with @@species, but I couldn't find the right bugs at this time.

[evilpie]

Additionally without indexed accessors, don't we still need to worry about proxies?

[natashenka]

I haven't found any, or seen any externally reported in Firefox, though I haven't taken a look in a while. There have been a few issues with Proxies, but index accessors cause more problems because they won't be detected by a type check.