1081971 - This script can make browser completely unresponsive and hangs it

Status: RESOLVED WORKSFORME

(Core :: JavaScript: GC, defect)

Description

[Sachin Thakuri]

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:26.0) Gecko/20100101 Firefox/26.0
Build ID: 20131206151508

Steps to reproduce:

Hi,
Visitng a webpage where this javascript is embedded 
<script>
document.location = 'data:text/html,\<script\>document.location += document.location + 
document.location\</script\>';
</script>
Can crash all version of chrome on both linux and windows.


Actual results:

The broswer completely hangs consuming all memory.
The script makes high number of redirection which firefox is not capable to handle thus makes it completely unresponsive and the only option left is to forse close the browser.


Expected results:

There must some limitation from browser for example 100 redirection in a minute in a tab. Or, the tab that opened the page must only crash not the whole browser.

Comment 1

[Daniel Veditz [:dveditz]]

This is a variation on the exponentially-growing-strings DoS. Sandboxing will limit the crash to the malicious tab.

Comment 2

[Nicolas B. Pierron [:nbp] {back on 17/11}]

This seems to be blocked now.