Firefox-maker Mozilla has detailed its recent efforts to harden the browser against code injection attacks.
That hardening work has focused on removing "potentially dangerous artifacts" in the Firefox codebase, including inline scripts and eval()-like functions, according to Mozilla's content security lead Christoph Kerschbaumer.
The removal of inline scripts is meant to improve protection for Firefox's 'about' protocol, more commonly known as about: pages.
SEE: 10 tips for new cybersecurity pros (free PDF)
There are dozens of these about: pages, which allow users to do things like display networking information, see how the browser is configured, and view installed plug-ins.
Mozilla had some concerns that attackers could use code injection attacks to abuse the about:config page, which "exposes an API to inspect and update preferences and settings, which allows Firefox users to tailor their Firefox instance to their specific needs", Kerschbaumer explains.
"Not allowing any inline script in any of the about: pages limits the attack surface of arbitrary code execution and hence provides a strong first line of defense against code injection attacks," notes Kerschbaumer.
"Eval() is a dangerous function, which executes the code it's passed with the privileges of the caller," Mozilla explains in developer support notes.
"If you run eval() with a string that could be affected by a malicious party, you may end up running malicious code on the user's machine with the permissions of your webpage / extension. More importantly, a third-party code can see the scope in which eval() was invoked, which can lead to possible attacks in ways to which the similar Function is not susceptible."
Kerschbaumer describes the function as a "powerful yet dangerous tool" that introduces "significant attack surface for code injection, and we discourage its use in favor of safer alternatives".
"We rewrote all use of 'eval()'-like functions from system privileged contexts and from the parent process in the Firefox codebase. Additionally we added assertions, disallowing the use of 'eval()' and its relatives in system-privileged script contexts," he notes.
The purpose of this measure is to reduce the attack surface in Firefox and further discourage the function's use.
More on Mozilla and the Firefox browser
- Firefox paid support: Enterprise premium starts at $10 per installation, says Mozilla
- Mozilla launches Firefox VPN extension for US users
- Firefox 69 is out: Flash squeezed out, tracking protection on by default
- Upcoming Firefox update will decrease power usage on macOS by up to three times
- Mozilla CEO Chris Beard to depart at year end
- Mozilla CEO: Premium version of Firefox coming this fall
- Firefox blocks third-party web trackers by default
- Mozilla announces ban on Firefox extensions containing obfuscated code
- Mozilla: End of Firefox for Android slated for 2020 as Fenix rises
- Mozilla: Firefox to block cryptomining scripts hidden on websites by default
- How to add a custom search engine to Firefox mobile TechRepublic
- Certificate issue disabling add-ons in Firefox and Tor browser finally fixed TechRepublic