{"action":"created","issue":{"url":"https://api.github.com/repos/mozilla/addons-linter/issues/1000","repository_url":"https://api.github.com/repos/mozilla/addons-linter","labels_url":"https://api.github.com/repos/mozilla/addons-linter/issues/1000/labels{/name}","comments_url":"https://api.github.com/repos/mozilla/addons-linter/issues/1000/comments","events_url":"https://api.github.com/repos/mozilla/addons-linter/issues/1000/events","html_url":"https://github.com/mozilla/addons-linter/issues/1000","id":184101011,"number":1000,"title":"Angular 1.5.8 Ban","user":{"login":"kspearrin","id":1190944,"avatar_url":"https://avatars.githubusercontent.com/u/1190944?v=3","gravatar_id":"","url":"https://api.github.com/users/kspearrin","html_url":"https://github.com/kspearrin","followers_url":"https://api.github.com/users/kspearrin/followers","following_url":"https://api.github.com/users/kspearrin/following{/other_user}","gists_url":"https://api.github.com/users/kspearrin/gists{/gist_id}","starred_url":"https://api.github.com/users/kspearrin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kspearrin/subscriptions","organizations_url":"https://api.github.com/users/kspearrin/orgs","repos_url":"https://api.github.com/users/kspearrin/repos","events_url":"https://api.github.com/users/kspearrin/events{/privacy}","received_events_url":"https://api.github.com/users/kspearrin/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"wagnerand","id":873258,"avatar_url":"https://avatars.githubusercontent.com/u/873258?v=3","gravatar_id":"","url":"https://api.github.com/users/wagnerand","html_url":"https://github.com/wagnerand","followers_url":"https://api.github.com/users/wagnerand/followers","following_url":"https://api.github.com/users/wagnerand/following{/other_user}","gists_url":"https://api.github.com/users/wagnerand/gists{/gist_id}","starred_url":"https://api.github.com/users/wagnerand/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wagnerand/subscriptions","organizations_url":"https://api.github.com/users/wagnerand/orgs","repos_url":"https://api.github.com/users/wagnerand/repos","events_url":"https://api.github.com/users/wagnerand/events{/privacy}","received_events_url":"https://api.github.com/users/wagnerand/received_events","type":"User","site_admin":false},"assignees":[{"login":"wagnerand","id":873258,"avatar_url":"https://avatars.githubusercontent.com/u/873258?v=3","gravatar_id":"","url":"https://api.github.com/users/wagnerand","html_url":"https://github.com/wagnerand","followers_url":"https://api.github.com/users/wagnerand/followers","following_url":"https://api.github.com/users/wagnerand/following{/other_user}","gists_url":"https://api.github.com/users/wagnerand/gists{/gist_id}","starred_url":"https://api.github.com/users/wagnerand/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wagnerand/subscriptions","organizations_url":"https://api.github.com/users/wagnerand/orgs","repos_url":"https://api.github.com/users/wagnerand/repos","events_url":"https://api.github.com/users/wagnerand/events{/privacy}","received_events_url":"https://api.github.com/users/wagnerand/received_events","type":"User","site_admin":false}],"milestone":null,"comments":47,"created_at":"2016-10-19T23:39:05Z","updated_at":"2016-10-25T21:38:43Z","closed_at":null,"body":"### Describe the problem and steps to reproduce it:\r\nSubmit Web Extension API extension using Angular 1.5.8\r\n\r\n### What happened?\r\nLinter throws banned error with linked article.\r\n\r\n### What did you expect to happen?\r\nBetter explanation.\r\n\r\n### Anything else we should know?\r\nHey guys, we've been developing our new extension (https://github.com/bitwarden/browser) for months now and are hoping to bring it to Firefox. It has been on Chrome for a month or so now and we have great demand for Firefox. After a 1 month long wait for a review by the addons team here we were asked to make a slight change to remove some minified libraries. Now we go to re-submit our extension and we see that we can no longer publish it due to a ban on Angular 1.x outright. Obviously this sucks for us since we've invested so much time developing it over the past few months and can't just simply remove Angular without starting all over.\r\n\r\nThe linked slideshare about why it has been banned (http://www.slideshare.net/x00mario/an-abusive-relationship-with-angularjs) is from December 2015 and gives no indication that this is still a vulnerability. It even says Google has resolved it.\r\n\r\nWe are using the latest versions on Angular (1.5.8) and had no plans to update to 2.x since it's still so fresh and Google claims it will continue to support the 1.x versions for a long time.\r\n\r\nCan you please shed further light as to why 1.5.8 is now banned? Do we have any other options rather than re-write our entire extension all over again? Can a more detailed, cooperative review allow us to bypass this all out ban?\r\n\r\nThank you."},"comment":{"url":"https://api.github.com/repos/mozilla/addons-linter/issues/comments/256183820","html_url":"https://github.com/mozilla/addons-linter/issues/1000#issuecomment-256183820","issue_url":"https://api.github.com/repos/mozilla/addons-linter/issues/1000","id":256183820,"user":{"login":"cure53","id":6709482,"avatar_url":"https://avatars.githubusercontent.com/u/6709482?v=3","gravatar_id":"","url":"https://api.github.com/users/cure53","html_url":"https://github.com/cure53","followers_url":"https://api.github.com/users/cure53/followers","following_url":"https://api.github.com/users/cure53/following{/other_user}","gists_url":"https://api.github.com/users/cure53/gists{/gist_id}","starred_url":"https://api.github.com/users/cure53/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cure53/subscriptions","organizations_url":"https://api.github.com/users/cure53/orgs","repos_url":"https://api.github.com/users/cure53/repos","events_url":"https://api.github.com/users/cure53/events{/privacy}","received_events_url":"https://api.github.com/users/cure53/received_events","type":"User","site_admin":false},"created_at":"2016-10-25T21:38:42Z","updated_at":"2016-10-25T21:38:42Z","body":"Hi @mrcktz,\r\n\r\n> your team leader is the author of the slides that were linked in the rejection notice by Mozilla\r\n\r\nThat is correct, writing here in person.\r\n\r\n> What is this fundamental design issue that differentiates angular from other libraries\r\n\r\nAngularJS, under certain conditions, allows to bypass parts of CSP. CSP, among the many goals it has, aims to block execution of inline JavaScript (i.e. `<h1 onclick=evil()>`). AngularJS however supports `<h1 ng-click=$event.view.evil()>` when run with its own CSP-mode. That bypasses CSP *if the stars are aligned right*. The stars are known to be quite alignment-friendly here and there. \r\n\r\nAlso please note that my example above uses an old bypass. Newer bypasses have been posted by [Google](https://sites.google.com/site/bughunteruniversity/nonvuln/angularjs-expression-sandbox-bypass) and @thejh ([here](https://twitter.com/tehjh/status/789309231585456129)). \r\n\r\nWhile I wouldn't say that the library should be _banned_ without giving it further thought, there is definitely an increase of attack surface. That is being worked on as we speak.\r\n\r\n> Most importantly: Are there other libraries that should also be banned because of similar reasons?\r\n\r\nNot to my knowledge, but who knows what kinds of libraries exist out there :) Probably there are.\r\n\r\n> Why would someone report to Mozilla and only to Mozilla?\r\n\r\nI am not aware of any conversation where that kind information was reported exclusively. \r\n\r\nOur (mostly poorly done) research is public [here](http://www.slideshare.net/x00mario/jsmvcomfg-to-sternly-look-at-javascript-mvc-and-templating-frameworks) and [here](http://www.slideshare.net/x00mario/an-abusive-relationship-with-angularjs) and [here](https://twitter.com/0x6D6172696F/status/757517148847738880). We had and have good contact to the AngularJS team (starting [2013](https://docs.google.com/document/d/1epha4VgFZVvauFJb2Tx_3NJlb3D91PjyZuO5YNAMX0M/edit) and lasting until today, cc @petebacondarwin @IgorMinar), Google and Mozilla. \r\n\r\nAn exclusive, AngularJS-related report to AMO never happened to my knowledge. Would have made no sense in any way either :) Likely a misunderstanding of some kind - I first time heard of this case four days ago.  "}}
{"actor":{"display_login":"cure53"}}