Is a closure's scope accessible by untrusted code?

[Andrey Fedorov]

Is the scope of a closure accessible after it's been created? Is it
safe against XSS to use closures to store "private" auth tokens? In
particular, in...

function closure(token) {
return function () {
// code which uses token to authenticate
}
}

foo = closure(secret);
delete secret;

// untrusted code

....can untrusted code access 'secret', or only the code inside foo?

- Andrey

[Richard Cornford]

On Oct 24, 1:57 pm, Andrey Fedorov wrote:

Is the scope of a closure accessible after it's been created?

The scope is handled internally by the implementation; you probably
mean 'are the objects on the scope chain accessible after it has been
created', or at least those not added to a scope chain with a - with -
statement or the global object (the latter always being accessible).
In pure ECMAScript terms the answer is no. However, in javascript
terms the answer would be 'don't rely on that', as implementations
have provided mechanisms for setting/re-establishing scopes for
function calls. See:-

<URL: http://peter.michaux.ca/article/8069 >

Is it safe against XSS to use closures to store "private"
auth tokens?

Almost certainly not. Not necessarily for any reasons related to
closures but rather questions like how these "auth tokens" got to the
javascript code without being exposed. (If they are in the page source
or the source of an (even dynamically generated) JS file how can you
be certain that the text cannot be retrieved from the DOM, and if XML
HTTP requested how can you be certain that the XSS script did not wrap
the XML HTTP request object, etc.?)

In particular, in...

>function closure(token) {
return function () {
// code which uses token to authenticate
}
}

>foo = closure(secret);
delete secret;

>// untrusted code

...can untrusted code access 'secret', or only the code inside foo?

Even if it cannot does it need to? The - foo - value is exposed and
can be modified, and its source code extracted to form the basis for
that modification.

Richard.

[Andrey Fedorov]

Thanks for the thorough response -

how can you be certain that the XSS script did not wrap
the XML HTTP request object

By making sure all user-submitted data are rendered only after the
closures which use auth-token have been created.

Thanks also for the link to Peter's blog, I was looking for that - the
issue appears to have been closed in in FF >= 3.1. I agree that this
isn't a solid solution, but might provide at least somewhat of a
barrier against some attacks.

Cheers,
Andrey