0

As I understand it, JavaScript implementations running in browsers need to run untrusted code and operate on untrusted data in a secure manner. Language (e.g. Python) implementations running on a server, OTOH, run trusted code and only need to securely handle untrusted data.

Does this difference mean that the two language implementations need to solve fundamentally different problems, security-wise?

Are there attacks which are possible via untrusted code and data, but not via untrusted data only? If so, presumably a Python implementation can afford to ignore these types of attack, but a JS implementation would have to be secure against them?

Or should all attacks that are possible via untrusted code also be considered possible via just untrusted data? In which case Python implementations should employ as many security features as JS implementations?

In other words, is it a simpler task to secure a language implementation against malicious data only, compared to both malicious data and malicious code?

  • 2
    Server-side code needs to secure the server side. Client-side code needs to secure the client side. those are two different threats and two different problems. – schroeder May 28 '18 at 15:55
  • 3
    language doesn't really matter here, the issue is topology (front/back) and differing threats. – dandavis Jun 27 '18 at 17:27
1

Are there attacks which are possible via untrusted code and data, but not via untrusted data only?

If you can trust the code you can usually use this trusted code to validate the untrusted data before further processing the data. If the code is untrusted too this is not possible. That's why the Javascript engine inside the browser (which is executing untrusted code) is running inside a limited environment (sandbox) so that the untrusted code cannot do harm to the underlying system. This means for example that file and network access is severely limited.

There are cases where the attacker manages to inject its own code into trusted execution environments. If this is the case the attackers code has the same level of trust then the other trusted code and can thus cause massive damage given that the assumption for the environment was that the code can be trusted. A typical example of such injection is to call eval on attacker provided data, thus interpreting these data as trusted code.

In other words, is it a simpler task to secure a language implementation against malicious data only, compared to both malicious data and malicious code?

Yes, if the code can be fully trusted no additional restrictions need to be done to the execution environment since it can be expected that the trusted code properly validates the untrusted data. Of course restrictions are recommended nevertheless as part of defense in depth since most complex code has bugs.

If on the other hand the code cannot be trusted it is essential to limit what the execution environment can do. This makes it more complex since this protection is needed additionally to the existing language. And, all the bugs in the last years within the Java Sandbox show that designing and implementing such a restricted execution environment is not easy.

0

Are there attacks which are possible via untrusted code and data, but not via untrusted data only? If so, presumably a Python implementation can afford to ignore these types of attack, but a JS implementation would have to be secure against them?

One example is the ability to measure time with high precision (timers, concurrent loops). Such timers are required to exploit Spectre-like vulnerabilities. To mitigate the vulnerability some browsers reduce the resolution of JavaScript timers. A server-side execution environment does not need such a restriction.

  • Note that even the reduced resolution of performance.now() and similar timers is not always particularly effective, given the fact that a fast JIT loop can behave as a high-resolution timer. – forest Sep 26 '18 at 2:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.