An Analysis of the Mozilla Jetpack Extension Framework

Abstract. The Jetpack framework is Mozilla’s newly-introduced extension development technology. Motivated primarily by the need to improve how scriptable extensions (also called addons in Firefox parlance) are developed, the Jetpack framework structures addons as a collection of modules. Modules are isolated from each other, and communicate with other modules via cleanly-defined interfaces. Jetpack also recommends that each module satisfy the principle of least authority (POLA). The overall goal of the Jetpack framework is to ensure that the effects of any vulnerabilities are contained within a module. Its modular structure also facilitates code reuse across addons. In this paper, we study the extent to which the Jetpack framework achieves its goals. Specifically, we use static analysis to study capability leaks in Jetpack modules and addons. We implemented Beacon, a static analysis tool to identify the leaks and used it to analyze 77 core modules from the Jetpack framework and an...

• Type: Journal
• Year: 2012
• Where: ECOOP
• Authors: Rezwana Karim, Mohan Dhawan, Vinod Ganapathy, Chung-chieh Shan
• Keywords: Core Modules, ECOOP 2012, Framework Structures, Programming Languages, Static Analysis Tool