Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Decide on earliest platforms we support, and refuse to run on earlier platforms #22

Open
3 tasks
jfparadis opened this issue Nov 30, 2019 · 1 comment
Open
3 tasks
Assignees
Labels
confinement Pertaining to confinement of guest programs. kriskowal-review-2024-01 Issues that kriskowal wants to bring to the attention of the team for review as of January, 2024

Comments

@jfparadis
Copy link
Contributor

jfparadis commented Nov 30, 2019

Instead of supporting workarounds for bugs present on older platforms, maintain a narrow list of platforms, and perform sanity tests on load. See tc39/proposal-shadowrealm#175

@jfparadis
Copy link
Contributor Author

Referencing comments by @erights in tc39/proposal-shadowrealm#175

The advisories: https://github.com/google/caja/wiki/SecurityAdvisories

For each of these, we should classify if they are relevant to modern Realms, Frozen Realms, or SES. Of the relevant ones, we should document whether there is anything there we should still worry about, and why or why not.

Especially interesting relevant advisory: https://github.com/google/caja/wiki/SecurityAdvisory20150313
Mostly, this advisory has to do with ancient browser bugs we no longer need to worry about. But we need to decide what the minimal versions are of all platforms that we do support, and ideally refuse to run on earlier platforms.

For the bugs of earlier platforms that we believe we no longer need to worry about on modern platforms, the old Caja/SES (usually in repairES5.js) has tests for those cases, to ensure they stay fixed. We need to make sure there are test262 tests for each of these, translating these old Caja/SES tests to test262 as needed.

Examples include both the advisory above and https://github.com/google/caja/wiki/SecurityAdvisory201308013

https://github.com/google/caja/wiki/SecurityAdvisory20130410 is an example of a vulnerability we have already fixed in the Realms shim, but only after independently rediscovering the issue.

@jfparadis jfparadis transferred this issue from Agoric/evaluator-shim Feb 14, 2020
@erights erights added the confinement Pertaining to confinement of guest programs. label Apr 19, 2020
kriskowal pushed a commit that referenced this issue Jan 12, 2022
@kriskowal kriskowal added the kriskowal-review-2024-01 Issues that kriskowal wants to bring to the attention of the team for review as of January, 2024 label Jan 10, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
confinement Pertaining to confinement of guest programs. kriskowal-review-2024-01 Issues that kriskowal wants to bring to the attention of the team for review as of January, 2024
Projects
None yet
Development

No branches or pull requests

3 participants