\input zb-basic
\input zb-ioport
\iteman{io-port 06086777}
\itemau{Karim, Rezwana; Dhawan, Mohan; Ganapathy, Vinod; Shan, Chung-chieh}
\itemti{An analysis of the Mozilla Jetpack extension framework.}
\itemso{Noble, James (ed.), ECOOP 2012 -- object-oriented programming. 26th European conference, Beijing, China, June 11--16, 2012. Proceedings. Berlin: Springer (ISBN 978-3-642-31056-0/pbk). Lecture Notes in Computer Science 7313, 333-355 (2012).}
\itemab
Summary: The Jetpack framework is Mozilla's newly-introduced extension development technology. Motivated primarily by the need to improve how scriptable extensions (also called addons in Firefox parlance) are developed, the Jetpack framework structures addons as a collection of modules. Modules are isolated from each other, and communicate with other modules via cleanly-defined interfaces. Jetpack also recommends that each module satisfy the principle of least authority (POLA). The overall goal of the Jetpack framework is to ensure that the effects of any vulnerabilities are contained within a module. Its modular structure also facilitates code reuse across addons. In this paper, we study the extent to which the Jetpack framework achieves its goals. Specifically, we use static analysis to study capability leaks in Jetpack modules and addons. We implemented Beacon, a static analysis tool to identify the leaks and used it to analyze 77 core modules from the Jetpack framework and another 359 Jetpack addons. In total, Beacon analyzed over 600 Jetpack modules and detected 12 capability leaks in 4 core modules and another 24 capability leaks in 7 Jetpack addons. Beacon also detected 10 over-privileged core modules. We have shared the details with Mozilla who have acknowledged our findings.
\itemrv{~}
\itemcc{}
\itemut{}
\itemli{doi:10.1007/978-3-642-31057-7\_16}
\end