Issue metadata
Sign in to add a comment
|
Security: Code in fetch().catch() block executes even after reload or navigation
Reported by
a...@brainfood.com,
Nov 6 2017
|
||||||||||||||||||||||||
Issue descriptionVersion 60.0.3112.78 (Official Build) (64-bit) OS: Debian Linux(jessie/stretch) A page-reload event causes any outstanding UPLOAD requests to send an error event. The error event then runs in a nebulous state, where the javascript context has been partially deconstructed(no console.log output), but you can see it still running via network requests that continue to show up in the debugger network panel. This bug requires a CORS configured server that allows for large(1M) POSTs.
,
Nov 6 2017
I was going to attach an example express-based server, but then noticed it wasn't even needed.
,
Nov 8 2017
Interesting. Are you able to replicate this issue in a current version of Chrome (e.g. Chrome 62+)?
,
Nov 8 2017
I don't think this is V8-related. To me it sounds like this is something the embedder (blink) should handle.
,
Nov 8 2017
I just upgraded a windows machine to: Version 62.0.3202.89 (Official Build) (64-bit) My debian system has over 100 tabs(in various windows), so upgrading that is difficult(I'm in the middle of website development). The bug still occurs in 62, on windows, and 60, on linux.
,
Nov 8 2017
Thank you for providing more feedback. Adding requester "elawrence@chromium.org" to the cc list and removing "Needs-Feedback" label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Nov 8 2017
Firefox 45 does not have this problem. A reload stops the the background code.
,
Nov 8 2017
In reproducing this, I find that the requests continue if I reload the page or perform a same-origin navigation. However, if I navigate to a foreign page (either on a different host, or about:blank), the background requests stop. Have you found a way to keep the requests going when that's not the case? If not, then the security implications of this seem especially mild (since the current page in the domain could simply continue issuing the requests directly).
,
Nov 8 2017
Tentatively triaging as low severity, though it's not clear to me that there are meaningful security implications. tyoshino, could you please take a look and see if you can suggest an appropriate owner?
,
Nov 9 2017
I can confirm that browsing from my test server seems to stop the background. I was also trying to make a setInterval(busyLoop) thing, but I have to switch back to real work for end-of-day. I can try poking a bit more tomorrow, but this does appear limited to $currentDomain.
,
Nov 9 2017
,
Nov 9 2017
Yutaka, could you please take a look?
,
Nov 9 2017
Is this dup of issue 726302 ?
,
Nov 9 2017
RE #13: Yes, it looks like a duplicate to me.
,
Nov 9 2017
,
Nov 10 2017
,
Feb 16 2018
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||||
Comment 1 by a...@brainfood.com
, Nov 6 2017