I am an avid user of Workflowy (online outliner/note taking tool) and I installed the Chrome extension 'Workflowy for Coders', which formats the text within notes.

I discovered that one of my notes triggered a Javascript XSS (because it was a sample of XSS (<script>document.location="http://google.com";</script>) ). The vulnerability stopped when I disabled the extension.

I sent notes, both to Workflowy and to the extension creator, but I'm curious, who is technically responsible? Workflowy, the extension creator, or Chrome? I could not think of a clear answer to that question.

If there is no clear answer, there might be wider implications for web developers.

  • Well I guess it depends how the XSS is handled in other plugins. If this works in every potential plugin, Google can be bad-PRed for this. – Andrew Smith Aug 30 '12 at 23:25
  • 3
    This would be hard to answer without any more information on the XSS vulnerability. – user10211 Aug 31 '12 at 2:21
  • added to original post – schroeder Aug 31 '12 at 3:27
  • @schroeder Please disclose this vulnerability to the developer immediately. Dropping it here isn't exactly in line with responsible disclosure methods, and there's no way for us to scrub out the details you described, since they're still in the history if we edit. Plus it looks like a cool extension and I'd hate to see it fall into disrepute over something like this. – Polynomial Aug 31 '12 at 6:08
  • @polynomial I did state that I notified the parties involved. – schroeder Aug 31 '12 at 20:10

The fault is almost certainly that of the Workflowy extension. It is the extension developer's responsibility to ensure their extensions are secure, and avoid introducing mistakes like XSS vulnerabilities into their extensions.

XSS vulnerabilities are common in browser extensions. It is easy for extension developers to screw up and introduce a XSS vulnerability, and extension developers often aren't focused primarily on security and may not be very aware of security issues, so security vulnerabilities in browser extensions are common.

Actually, Chrome is at the forefront of developing mitigations against these kinds of vulnerabilities. While the responsibility is ultimately with the extension developer, Chrome recently introduced powerful mitigations that make XSS vulnerabilities in new extensions less likely. These mitigations rely upon restricting extensions, using a Content Security Policy, in a way that helps prevent XSS vulnerabilities.

For backwards compatibility reasons, the new restrictions only apply to new extensions. It will take some time for these new defenses to be phased in fully. That said, this is a great development. It will really help protect users. I hope that other browsers follow suit.

For more on this topic, here is a recent research paper on this subject:

Some sample findings from the paper:

  • An analysis of 100 randomly selected Chrome extensions found that 40% of Chrome extensions had at least one security vulnerability.

  • The same analysis also found that Chrome's new defenses should eliminate 94% of the most serious vulnerabilities.

See also a blog post summarizing the paper's findings, and another follow-up.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.