1425674 - Browser stops responding when doing ToString on a large value in the devtools console

Status: RESOLVED INVALID

(DevTools :: Console, defect, P3)

Description

[Dibyendu Sikdar]

Attachment: firefox_exploit.mp4

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.108 Safari/537.36

Steps to reproduce:

Certain Javascript code causes memory exhaustion in which makes Firefox unresponsive.

Full Exploit

Step 1.  Open any tab , go to developer console
Step 2.  Type this code and press enter  

              var a = new Array(999999999);

Step 3:  Type this code and press enter

              a+1

Results:

             Browser stops responding


Actual results:

Browser became slow, stopped responding


Expected results:

The application should not stop responding.

Comment 1

[:Gijs (he/him)]

What's slow is not necessarily memory exhaustion, it's the devtools trying to show you a string for the ~ 1 billion entry array with a "1" at the end (so a 2gb string given the use of utf16/ucs2 for JS strings). Compare evaluating:

["foo", "bar"] + 1

which shows "foobar1".

This is sec-low at best, also because it involves the developer console, and because it's basically just DoS, which is a dime a dozen on the web.

Running this code alone on a webpage only hangs the current tab, and we correctly give the user an easy way of closing that tab. I doubt the JS team will want to do something about this (and I'm not sure whether they *can* do anything), but just in case, moving over there and they can decide what needs to happen with this bug.

Comment 2

[Jason Orendorff [:jorendorff]]

The JavaScript engine has the ability to cancel long-running code. For example, in a command-line build of the JavaScript shell, there's a `timeout()` function that turns this feature on.

    js> var a = new Array(999999999);
    js> timeout(3);  // make the timeout 3 seconds
    js> a + 1   // runs for 3 seconds before being killed
    js>

So I think we could do something for the console. I don't know what the right timeout is or how to present it to the user, but the raw capability is there.

I'll put this on the agenda for the next JS-devtools meeting (January 9).

Comment 3

[Dibyendu Sikdar]

The bug can be exploited without the dev console. Here is the poc code

<!DOCTYPE html>
<html>
<head>
	<title></title>
</head>
<body>
<script type="text/javascript">
	console.log("Trigerring Exploit");
	var a = new Array(999999999);
	a+1;
	a+1;
	console.log("Completed trigerring Exploit");
</script>
</body>
</html>

Comment 4

[Jason Orendorff [:jorendorff]]

What I observe when I load the web page in comment 3 is:

* Page starts to load, the dot dances back and forth.
* I can click to other tabs and do work. The browser remains responsive.
* After a few seconds, a yellow stripe appears telling me that a web page is slowing down the browser
* I can click "Stop It", and we kill the script.

With the dev console open, I get the same behavior.

This seems pretty great! Is there something we should be doing differently?

Comment 5

[Nicolas Chevobbe [:nchevobbe]]

Not sure what can be done in DevTools. As Comment 4 stated, the "Slow script" toolbar shows up and you can then kill the script, which makes the page responsive again.

Comment 6

[Nicolas Chevobbe [:nchevobbe]]

As previously said, the slow script warning appears (either when evaluation is done in the console or in a content script), so we can probably close this.