1317573 - Browser (parent) hang due to spawning setTimeouts/re-navigating

Status: NEW

(Core :: DOM: Core & HTML, defect, P3)

Description

[Dhiraj Mishra]

Attachment: POC-MOZILLA.ZIP

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0
Build ID: 20161019084923

Steps to reproduce:

* Visit : http://hackies.in/spoof.html
* Hit Go
*  Address bar says facebook.com;
    Content is not facebook.com.
* While closing the Tab Browser crashes.


Actual results:

VULNERABILITY DETAILS
Address Spoofing:
    Address bar says facebook.com;
    Content is not facebook.com.

URL :  http://hackies.in/spoof.html


Expected results:

For crashes please include the following additional information attached POC below.

Comment 1

[Dhiraj Mishra]

The timer setTimeout() is actually set to 4 seconds. Locally, the spoofed content gets displayed for the time mention in the code (Time value van be extended) to make the spoof page stable.
However by closing the spoofed tab the browser crashed.
In my attempts to repro, the page always goes blank after a short delay, both on Linux and Windows. I'm sure that it's possible to tweak the parameters to DoS the browser and delay the blank paint, but that's fragile and is unlikely to work well across machines.

Thank you

Comment 2

[Daniel Veditz [:dveditz]]

This isn't really spoofing -- you've hung the browser on the way to navigating, and there's always a brief period where the new URL is shown on top of the old content.

The hang is a denial of service that would be worth looking at.

Comment 3

[Dhiraj Mishra]

Hi Daniel , 

Any update on this bug !

Comment 4

[Emil Pasca [:emilpasca]]

User Agent:  Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:53.0) Gecko/20100101 Firefox/53.0

I have tested this issue on Windows 10 x64 with the latest Firefox release (50.1.0) and the latest Nightly (53.0a1-20170108030212) with e10s enabled/disabled and managed to reproduce it following the steps described in the description.
When hitting the "Go" link, the pop-up window with the content is displayed and the browser hangs.

I was able to get a cleopatra profile:
https://new.cleopatra.io/public/aa812b7b5312e15fb4e94dc56d8e0e3c35eab074/calltree/?thread=0

Moving this to Core:DOM, perhaps there's someone with extensive knowledge on this area that might be able to help here.

Comment 5

[Ben Kelly [:bkelly, not reviewing]]

Olli, should we be disallowing the setInterval() callbacks here after `window.location.replace()` navigation begins?

Comment 6

[Olli Pettay [:smaug][[e-mail]]]

If inner window is still the old one, why would we do that?

But don't we in this case anyhow keep the original page which just keeps adding more and more timeouts, or am I missing something here.

Comment 7

[Tanvi Vyas[:tanvi]]

I see a popup with the facebook.com in the url bar, and no content in the page instead of the facebook.com content.

But I don't get a browser hang.

Comment 8

[Tanvi Vyas[:tanvi]]

It does take up quite a bit of CPU power.  Tested in Firefox 58.0.1 on OSX.