Closed
Bug 1311596
Opened 8 years ago
Closed 4 years ago
DOS in browser using window.print() function
Categories
(Core :: DOM: Core & HTML, defect, P3)
Tracking
()
RESOLVED
FIXED
87 Branch
| Tracking | Status | |
|---|---|---|
| firefox87 | --- | fixed |
People
(Reporter: sweetshanuu, Unassigned)
References
Details
(Keywords: csectype-dos, hang, Whiteboard: [sg:dos][fixed by Bug 1692232])
Attachments
(1 file)
|
2.15 MB,
video/mp4
|
Details |
User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0
Build ID: 20160922113459
Steps to reproduce:
1.Save the below script as html file
<html>
<title>DoS</title>
<script>
function test(){
window.onerror=new Function(history.go(window.open(window.print())));
}
test();
</script>
</html>
2.Open the html file in firefox browser
Actual results:
Print window will appear again and again causing dos
Expected results:
We should limit the times window.print can happen
|
||
Updated•8 years ago
|
Group: firefox-core-security → dom-core-security
Component: Untriaged → DOM
Product: Firefox → Core
Hi,
marked by bug #1311596 as duplicate of #1311670
Which one is latest? i see that my report id is earlier than you mentioned id,
COuld you confirm
|
||
Comment 3•8 years ago
|
||
This is a Denial of Service attack. Since the testcase is identical to bug 1311670 (not just the same problem, but the same PoC code) I assume this must be public on a formum somewhere.
Group: dom-core-security
Status: UNCONFIRMED → NEW
Ever confirmed: true
Keywords: csectype-dos,
hang
Whiteboard: [sg:dos]
|
||
Updated•8 years ago
|
Priority: -- → P3
|
Assignee | |
Updated•6 years ago
|
Component: DOM → DOM: Core & HTML
|
||
Comment 6•5 years ago
•
|
||
Looking into (window) modal prompts I've rediscovered this. While the main print dialog seems to have rate limit logic, the print error messages do not. When window.print() is spammed in a simple while loop these error prompts stack and steal main window focus.
Could be abused similar to Bug 1571003.
PoC here: https://eviltrap. site/trap/print-dialog-dos/ (careful, this will DoS your browser)
|
|
||
Comment 8•4 years ago
|
||
Yes, should be fixed. I can't reproduce the issue anymore with the PoC from comment 6. Users can simply close the tab now when a site spams window.print.
Status: NEW → RESOLVED
Closed: 4 years ago
status-firefox87:
--- → fixed
Flags: needinfo?(pbz)
Resolution: --- → FIXED
See Also: → 1692232
Whiteboard: [sg:dos] → [sg:dos][fixed by Bug 1692232]
Target Milestone: --- → 87 Branch
You need to log in
before you can comment on or make changes to this bug.
Description
•