Calling history.replaceState too quickly causes application-wide DoS
Reported by
chandler...@gmail.com,
Mar 16 2017
|
||||||
Issue description
Chrome Version : 56.0.2924.87 (Official Build) (64-bit)
URLs (if applicable) :
Other browsers tested:
Add OK or FAIL, along with the version, after other browsers where you
have tested this issue:
Safari: OK 10.0.2 (12602.3.12.0.1)
Firefox: FAIL 52.0 (64-bit)
What steps will reproduce the problem?
(1) Execute the following JavaScript:
for(let i = 0; i < 10000000; i++) {
window.history.replaceState({}, null, location.href)
}
What is the expected result?
Lock up the current tab.
What happens instead?
Entire browser application is locked, can switch between tabs but not interact. Cannot open new tabs. Cannot kill offending tab via Chrome's Task Manager.
Please provide any additional information below. Attach a screenshot if
possible.
Firefox exhibits the same result, though eventually asking if you want to kill a long-running script, it remains locked after attempting to kill the script.
Safari displays the following warning in the developer console: SecurityError (DOM Exception 18): Attempt to use history.replaceState() more than 100 times per 30.000000 seconds
,
Mar 17 2017
It seems like this is more of a Blink issue but @luoe do you think it's worth putting in some kind of console messaging / throttling?
,
Mar 20 2017
This happens regardless of whether devtools is open.
,
Apr 5 2017
Not V8 related. Some popup should appear though and ask you to end script execution. rschoen was afaik thinking about a better solution for this in the past.
,
Apr 5 2017
If we're locking up the whole browser there must be some browser interaction, so not all Blink. Hard to know the right component, trying DOM.
,
Apr 5 2017
This is a long standing issue that many web platform APIs have that send IPCs to the browser process. kinuko@ has thought about possible solutions. Let's dupe to 394296 |
||||||
►
Sign in to add a comment |
||||||
Comment 1 by kavvaru@chromium.org
, Mar 17 2017Components: Blink>JavaScript Platform>DevTools
Labels: -Pri-3 M-59 OS-Linux OS-Windows Pri-1
Status: Untriaged (was: Unconfirmed)