Closed Bug 198943 Opened 23 years ago Closed 19 years ago

Browser hangs when checking certificate after submitting a javascript form

Categories

(Core :: Security, defect)

x86
Windows 2000
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 205287

People

(Reporter: dreadn, Assigned: security-bugs)

References

()

Details

(Keywords: crash, hang)

Attachments

(1 file)

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.3) Gecko/20030312 Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.3) Gecko/20030312 In the page www.vodafoneomnitel.it, in every member's service like sending Free SMS the browser crashes when submitting the SMS form. The button has this function --> javascript:void(0); Reproducible: Always Steps to Reproduce: 1.Enter the site 2.Log in 3.Select Free SMS to any omnitel mobile phone 4.Fill in the text and the phone number 5.Push "INVIA" button Actual Results: Browser crashes Expected Results: Visualize a window with the confiration message for the SMS No information
FRAME SOURCE OF THE PAGE: <script> var MobilePref = '320,328,329,340,330,333,334,335,336,337,338,339,346,347,348,349,360,368,380,388,389' var OmnitelPref = '340,346,347,348,349' </script> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd"> <html> <head> <title>Omnitel - Area Privati - Servizi Interattivi - SMS</title> <script LANGUAGE="JavaScript1.2" SRC="/common/include/style_select.js" type="text/javascript"></SCRIPT> <script LANGUAGE="JavaScript1.2" SRC="/common/include/js_functions.js" type="text/javascript"></SCRIPT> <script LANGUAGE="JavaScript1.2" SRC="/common/include/validation.js" type="text/javascript"></SCRIPT> <script language="JavaScript" src="/Global/_ScriptLibrary/rs.htm"></script> <script language="JavaScript">RSEnableRemoteScripting("/Global/_ScriptLibrary");</script> </head> <body background="/common/images/sfondo_main.gif" text="#000000" link="#000000" alink="#000000" vlink="#000000"> <table border="0" cellpadding="0" cellspacing="0" width="620"> <tr> <td valign="top" width="465"> <!-- Inizio Barra grigia --> <table width="465" border="0" cellspacing="0" cellpadding="1"> <tr valign="top"> <td bgcolor="#EEEEEE"> <p class="nero">&nbsp;area privati &gt; servizi interattivi &gt; sms</p> </td> </tr> </table> <!-- Fine Barra grigia --> <!--CONTENUTI--> <p><img src="images/sms.gif" width="58" height="27" alt=""></p> <p>Con questo servizio puoi inviare gratuitamente Brevi Messaggi di Testo (SMS) ai telefoni cellulari Vodafone Omnitel</p> <ul> <li>Il messaggio non pu&ograve; superare la lunghezza massima di <b>1200 caratteri</b>.</li> <li>E' possibile inviare fino a <b>100 SMS ogni giorno</b>.</li> </ul> <script language="JavaScript"> <!-- function ControlloSim(Numero){ var Sim; Sim=RSExecute("/Global/Include/RsMNP.asp","Controllo",Numero) if (Sim.status != 0){alert(Sim.data);return false;} if (!Sim.return_value){ alert("Attenzione la Sim inserita non risulta essere un numero Omnitel."); return false; } return true; } function SMS_HP_OpenPopup(strUrl){ var winPop; winPop=window.open(strUrl,"SmsFree","toolbar=no,directories=no,menubar=no,scrollbars=yes,width=470,height=350"); winPop.focus(); } function SMS_HP_OpenMessagePopup(strUrl){ var winPop; winPop=window.open(strUrl,"MessagePpp","toolbar=no,directories=no,menubar=no,scrollbars=yes,width=470,height=350"); winPop.focus(); } function SMS_HP_Help(){ var winPop; winPop=window.open("SMS_HP_help.asp?cmax=1200","SMS_HP_help","toolbar=no,directories=no,menubar=no,scrollbars=yes,width=470,height=350"); winPop.focus(); } function SMS_HP_Send(){ var strAction; var strEscape; var strReplace; var re; if (SMS_HP_ValidateForm()){ strEscape = escape(document.frmSendSMS.testo_sms.value); //ATTENZIONE: non cambiare mai l'ordine dei parametri nè il nome // degli stessi!!! // strAction = 'sms_hp_main.asp?pref=' + document.frmSendSMS.pref.options[document.frmSendSMS.pref.selectedIndex].value; strAction = 'sms_hp_main.asp?pref=' + document.frmSendSMS.pref.value; strAction+= '&num=' + document.frmSendSMS.num.value + '&msg=' + strEscape + '&cmax=1200&Prov=1&Controllo=True'; SMS_HP_OpenPopup(strAction); } } function SMS_HP_CheckFailure(){ var bRes; if("0" >= "1"){//Service Failure! SMS_HP_OpenMessagePopup('sms_hp_ServiceFailure.asp'); document.frmSendSMS.testo_sms.value = ""; document.frmSendSMS.num.value = ""; bRes=true; }else{ bRes = false; } return bRes; } function SMS_HP_CharCounter(){ var msgLen; var MaxLength; if(SMS_HP_CheckFailure()) return; MaxLength = 1200; msgLen=document.frmSendSMS.testo_sms.value.length; if (msgLen >= MaxLength ){ document.frmSendSMS.CharCount.value= "0"; }else{ document.frmSendSMS.CharCount.value = MaxLength - msgLen; } } function SMS_HP_ValidateForm(){ var strtesto_sms; if(SMS_HP_CheckFailure()) return false; strtesto_sms = new String(SMS_HP_trim(document.frmSendSMS.testo_sms.value)); //modifiche per controllo cellulari Vodafone Omnitel if (!isMobileNumber(window.document.frmSendSMS.num)) return false; if(!ControlloSim(window.document.frmSendSMS.num.value)) return false; // Controlla la lunghezza del testo immesso if((strtesto_sms.length > 1200)){ strAction = "sms_hp_Exceed.asp"; SMS_HP_OpenPopup(strAction); return false; } if(strtesto_sms.length == 0){ alert("Si prega di inserire un messaggio"); return false; } return true; } /***************************************************************** FILE DI FUNZIONI GLOBALI *****************************************************************/ // Elimina gli spazi iniziali e finali da una stringa function SMS_HP_trim(strSrc){ var strTemp; var t =0; var j; strTemp = new String(strSrc); while (strTemp.charAt(t++)==" "); t= t ? t-1 : t; j=strTemp.length; while (strTemp.charAt(j--)==" "); ++j; return strTemp.substring(t,j).valueOf(); } // Funzione di validazione del prefisso e del numero di telefono. function SMS_HP_checkPhoneNumber(Tel_Prefix,Tel_Number){ var T_Prefix, T_Number; T_Prefix =SMS_HP_trim(Tel_Prefix); T_Number = Tel_Number; // Validazione del prefisso if (T_Prefix == ""){ alert("Inserire un prefisso telefonico internazionale"); return false; } if (!SMS_HP_IsStringValid(T_Prefix, "1234567890")){ alert("Il prefisso telefonico internazionale inserito contiene caratteri non validi: sono accettati solo numeri"); return false; } if(T_Prefix.charAt(0) == "0"){ alert("Il prefisso telefonico internazionale va inserito senza nessuno 0 iniziale.\n\rPer l'Italia si deve digitare per esempio invece di 0039 solo 39."); return false; } // Validazione del numero di telefono if (T_Number == ""){ alert("Inserire un numero di telefono GSM, senza lo 0 iniziale"); return false; } if (!SMS_HP_IsStringValid(T_Number, "1234567890")){ alert("Il numero di telefono inserito contiene caratteri non validi: sono accettati solo numeri"); return false; } // 10/01 eliminato il controllo sulla lunghezza del numero di tel // esistono dei numeri (LITUANIA!: mail 10/1/2001) lunghi 8 // 11/01 nuova mail: ll minima del numero digitato = 4 if(T_Number.length < 4){ //Vecchi numeri di telefono: 3 di prefisso + 6 di numero alert("Il numero di telefono deve essere di almeno 4 cifre"); return false; } if(T_Number.charAt(0) == "0"){ alert("Il telefono cellulare va inserito con prefisso del gestore, ma senza nessuno 0 iniziale.\n\rPer esempio se il numero e\' 0347xxxxxx si dovra\' digitare: 347xxxxxx."); return false; } return true; } /***************************************************************** SMS_HP_IsStringValid Description: Funzione generica per controllare che una stringa contenga solo i caratteri indicati in szCompareString Return: boolean true - stringa corretta *****************************************************************/ function SMS_HP_IsStringValid(szPassedString, szCompareString){ var szTmpString = new String; var nLength = 0; var nIndex; szTmpString = szPassedString; nLength = szTmpString.length; for (nIndex = 0; nIndex < nLength; nIndex++){ if (szCompareString.indexOf(szTmpString.charAt(nIndex), 0) < 0){ return false; } } return true; } //--> </script> <p>L'area <a href="http://www.areaprivati.190.it/webcare/webcare.asp" target="main"><b>Assistenza Servizi Web</b></a> &egrave; a tua disposizione per comunicarci eventuali problemi riscontrati in fase di registrazione, accesso e utilizzo di tutti i servizi dell'area Privati.</p> <div align="center"> <form id="frmSendSMS" name="frmSendSMS"> <table cellspacing="0" cellpadding="0" border="0"> <tr> <td> <table cellspacing="0" cellpadding="0" border="0"> <tr> <td colspan="2" align="left"><img src="images/sms1.gif" border="0" alt></td> </tr> <tr> <td align="left" valign="top"><img src="images/sms2.gif" width="37" height="35" border="0" alt></td> <td rowspan="2" align="left" valign="top"> <textarea wrap="virtual" cols="16" rows="3" name="testo_sms" onchange="SMS_HP_CharCounter()" onkeyup="SMS_HP_CharCounter()"></textarea> </td> </tr> <tr> <td><a href="javascript:SMS_HP_Help()"><img src="images/help_sms.gif" width="37" height="17" border="0" alt></a></td> </tr> </table> </td> <td valign="bottom"> <table cellspacing="0" cellpadding="0" border="0"> <input type="hidden" name="pref" value="39"> <tr> <td></td> <td align="right"><p class="nerosm">Pref.Int.</p></td> <td></td> <td align="right"><p class="nerosm">Numero GSM</p></td> </tr> <tr> <td align="center" valign="middle" colspan="2"><p>+ 39</p> </td> <td>&nbsp;</td> <td align="left" valign="middle" onchange="SMS_HP_CharCounter()" onkeyup="SMS_HP_CharCounter()"> <input name="num" size="11" maxlength="10"> </td> </tr> <tr> <td height="10" colspan="4" align="right"><p class="nerosm">Es.: 39 3481234567</p></td> </tr> <tr> <td></td> <td colspan="3" valign="bottom"> <table cellspacing="0" cellpadding="0" border="0" width="100%"> <tr> <td><input type="text" name="CharCount" id="CharCount" size="4" maxlength="4"></td> <td><p class="nerosm">Caratteri<br>disponibili</p></td> <td align="right"><a href="javascript:void(0);" onclick="SMS_HP_Send()"><img src="images/invia_sms.gif" width="37" height="17" border="0" alt></a></td> </tr> </table> </td> </tr> </table> </td> </tr> </table> </form> </div> <script language="javascript"> <!-- if(1200 != -1){ document.frmSendSMS.CharCount.value = "1200"; } //--> </script> </td> <td width="3"><img height="3" src="/common/images/pixel.gif" width="3" alt=""></td> <td width="152" valign="top" align="right"> <!-- MENU DI DESTRA--> <script LANGUAGE="JavaScript"> <!-- function popUpElTel() { popUpWin('http://www.areaprivati.190.it/common/elenco_telefonico.htm','ElencoTelefonico','width=600,height=450,scrollbars=yes'); } //--> </script> <!-- Inizio Tabella Ricerca --> <form id="frmSearch" name="frmSearch" method="post" action="javascript:;" target="_top" onkeypress="javascript: if(event.keyCode == 13) { event.keyCode = 0; VZ_SubmitF1();}";> <!-- Cerca in tutto il sito --> <input type="Hidden" name="whrSearch" value="0"> <!-- Cerca singole parole --> <input type="Hidden" name="howSearch" value="0"> <table border="0" cellpadding="0" cellspacing="0"> <tr> <td align="left"><img src="/common/images/tit_ricerca.gif" border="0" width="62" height="13" alt=""></td> <td><img src="/common/images/pixel.gif" border="0" width="1" height="1" alt=""></td> <td width="10"><img src="/common/images/pixel.gif" width="10" height="1"></td> </tr> <tr> <td align="left"><input type="Text" name="q1" size="6" class="nerosm" style="width:90;" onkeypress="javascript: if(event.keyCode == 13) { event.keyCode = 0; VZ_SubmitF1();}"></td> <td width="25" align="right"><a href="javascript:VZ_SubmitF1()";><img src="/common/images/vai.gif" border="0" alt="Cerca" width="20" height="14"></a></td> <td width="10"><img src="/common/images/pixel.gif" width="10" height="1"></td> </tr> </table> </form> <!-- Fine Tabella Ricerca --> <!-- Inizio Box MyGalley 2002_06_12 --> <table width="152" border="0" cellspacing="0" cellpadding="0"> <tr> <td width="10"><img src="/common/images/pixel.gif" width="8" height="1" border="0" alt=""></td> <td width="142" align="center"> <img src="/common/images/pixel.gif" width="1" height="10" border="0" alt=""><br> <a href="http://www.areaprivati.190.it/index.asp?DestUrl=/infoservizi/mygallery.asp" target="_top"><img src="/images/mygallery.gif" width="120" height="65" border="0" alt=""></a><br> <img src="/common/images/pixel.gif" width="1" height="10" border="0" alt=""></td> </tr> </table> <!-- Fine Box MyGalley 2002_06_12 --> <!-- Inizio Tabella con Cornice --> <table width="152" border="0" cellspacing="0" cellpadding="0" bgcolor="#FFFFFF"> <tr> <td></td> <td colspan="3"><img src="/common/images/utilities_cornice_top.gif" width="144" height="21" border="0" alt=""></td> </tr> <tr> <td></td> <td width="2" bgcolor="#FE0000"><img src="/common/images/pixel.gif" width="2" height="1" border="0" alt=""></td> <td width="140"> <table width="140" border="0" cellspacing="0" cellpadding="0"> <tr> <td><img src="/common/images/pixel.gif" width="5" height="1" border="0" alt=""></td> <td><img src="/common/images/pixel.gif" width="15" height="1" border="0" alt=""></td> <td><img src="/common/images/pixel.gif" width="120" height="1" border="0" alt=""></td> </tr> <tr> <td></td> <td height="20" align="center"><img src="/common/images/pallino_verde_sml.gif" width="4" height="4" border="0" alt=""></td> <td height="20"><p><a href="http://www.areaprivati.190.it/serviziinterattivi/serviziinterattivi.asp" target="main">Servizi interattivi</a></p></td> </tr> <tr> <td></td> <td height="20" align="center"><img src="/common/images/pallino_verde_sml.gif" width="4" height="4" border="0" alt=""></td> <td height="20"><p><a href="http://imb.vizzavi.it" target="_blank">Mailbox</a></p></td> </tr> <tr> <td></td> <td height="20" align="center"><img src="/common/images/pallino_verde_sml.gif" width="4" height="4" border="0" alt=""></td> <td height="20"><p><a href="http://www.areaprivati.190.it/punti_vendita/punti_vendita.asp" target="main">Punti vendita</a></p></td> </tr> <tr> <td></td> <td height="20" align="center"><img src="/common/images/pallino_verde_sml.gif" width="4" height="4" border="0" alt=""></td> <td height="20"><p><a href="http://www.areaprivati.190.it/assist_tecnica/assist_tecnica.asp" target="main">Assistenza tecnica</a></p></td> </tr> <tr> <td></td> <td height="20" align="center"><img src="/common/images/pallino_verde_sml.gif" width="4" height="4" border="0" alt=""></td> <td height="20"><p><a href="http://www.areaprivati.190.it/mailing_list/mailing_list.asp" target="main">Mailing List</a></p></td> </tr> <tr> <td></td> <td height="20" align="center"><img src="/common/images/pallino_verde_sml.gif" width="4" height="4" border="0" alt=""></td> <td height="20"><p><a href="javascript:popUpElTel()" target="main">Elenco Telefonico</a></p></td> </tr> </table> </td> <td width="2" bgcolor="#FE0000"><img src="/common/images/pixel.gif" width="2" height="1" border="0" alt=""></td> </tr> <tr> <td><img src="/common/images/pixel.gif" width="8" height="1" border="0" alt=""></td> <td width="2" bgcolor="#FE0000"><img src="/common/images/pixel.gif" width="2" height="1" border="0" alt=""></td> <td width="140"><img src="/common/images/pixel.gif" width="140" height="1" border="0" alt=""></td> <td width="2" bgcolor="#FE0000"><img src="/common/images/pixel.gif" width="2" height="1" border="0" alt=""></td> </tr> <tr> <td></td> <td colspan="3"><img src="/common/images/help_cornice_bottom.gif" width="144" height="12" border="0" alt=""></td> </tr> </table> <!-- Fine Tabella con Cornice --> <!-- Inizio Tabella Separatore --> <table width="152" border="0" cellspacing="0" cellpadding="0"> <tr> <td height="20"></td> </tr> </table> <!-- Fine Tabella Separatore --> <!-- Inizio Tabella con Cornice --> <table width="152" border="0" cellspacing="0" cellpadding="0" bgcolor="#FFFFFF"> <tr> <td></td> <td colspan="3"><img src="/common/images/help_cornice_top.gif" width="144" height="21" border="0" alt=""></td> </tr> <tr> <td></td> <td width="2" bgcolor="#FE0000"><img src="/common/images/pixel.gif" width="2" height="1" border="0" alt=""></td> <td width="140"> <table width="140" border="0" cellspacing="0" cellpadding="0"> <tr> <td><img src="/common/images/pixel.gif" width="5" height="1" border="0" alt=""></td> <td><img src="/common/images/pixel.gif" width="15" height="1" border="0" alt=""></td> <td><img src="/common/images/pixel.gif" width="120" height="1" border="0" alt=""></td> </tr> <tr> <td></td> <td height="20" align="center"><img src="/common/images/pallino_verde_sml.gif" width="4" height="4" border="0" alt=""></td> <td height="20"><p><a href="http://www.areaprivati.190.it/faq/faq.asp" target="main">Faq</a></p></td> </tr> <tr> <td></td> <td height="20" align="center"><img src="/common/images/pallino_verde_sml.gif" width="4" height="4" border="0" alt=""></td> <td height="20"><p><a href="http://www.areaprivati.190.it/comunicaconnoi/comunicaconnoi.asp" target="main">Comunica con noi</a></p></td> </tr> <tr> <td></td> <td height="20" align="center"><img src="/common/images/pallino_verde_sml.gif" width="4" height="4" border="0" alt=""></td> <td height="20"><p><a href="http://www.areaprivati.190.it/mappa/mappa.asp" target="main">Mappa</a></p></td> </tr> </table> </td> <td width="2" bgcolor="#FE0000"><img src="/common/images/pixel.gif" width="2" height="1" border="0" alt=""></td> </tr> <tr> <td><img src="/common/images/pixel.gif" width="8" height="1" border="0" alt=""></td> <td width="2" bgcolor="#FE0000"><img src="/common/images/pixel.gif" width="2" height="1" border="0" alt=""></td> <td width="140"><img src="/common/images/pixel.gif" width="140" height="1" border="0" alt=""></td> <td width="2" bgcolor="#FE0000"><img src="/common/images/pixel.gif" width="2" height="1" border="0" alt=""></td> </tr> <tr> <td></td> <td colspan="3"><img src="/common/images/help_cornice_bottom.gif" width="144" height="12" border="0" alt=""></td> </tr> </table> <!-- Fine Tabella con Cornice --> <!-- FINE MENU DI DESTRA--> </td> </tr> <tr> <td width="465" height="10"><img src="/common/images/pixel.gif" width="465" height="1" border="0" alt=""></td> <td width="3" height="10"><img src="/common/images/pixel.gif" width="3" height="1" border="0" alt=""></td> <td width="152" height="10"><img src="/common/images/pixel.gif" width="152" height="1" border="0" alt=""></td> </tr> </table> </body> </html>
Flags: blocking1.3+
-> javascript engine
Assignee: form-submission → rogerl
Component: Form Submission → JavaScript Engine
Keywords: crash
QA Contact: ashishbhatt → pschwartau
Peter: this has nothing to do with JavaScript Engine. JavaScript Engine deals with the abstract JavaScript programming language. Specifically, low-level objects such as String(), Number(), and Date(). The JS Engine does not contain browser or DOM objects like window, document, forms, etc. Reassigning to Browser-General. We won't know the proper component until we get a stack trace. Andrea: can you download a Talkback-enabled build from the Mozilla ftp site? When you crash, please fill in the Talkback form, and a report will be sent to us containing a stack trace. You get the Talkback ID of your crash by running ../../mozilla/components/talkback.exe. Please post the IDs of the crashes in this bug, and we can look up the stack traces. Also: if a login is required to this site, would it be possible for you to create a test account, say with: User = mozilla Password = bugzilla Thanks -
Assignee: rogerl → asa
Component: JavaScript Engine → Browser-General
QA Contact: pschwartau → asa
I was analyzing the problem: 0) Download talkback enabled mozilla version, but nothing better, mozilla hangs and doesn't crashes. 1) I noticed SUN's JVM icon in the tray 2) I opened the java console and put trace level to '5' (all) 3) So, I do this snapshot: http://dreadnought.ngi.it/immagini/mozillaerror.png The text in the java console is looping, hogging the CPU and hanging mozilla, the only solution is kill the appllication. Killing the java console kills mozilla either. I don't know if the problem now is for javascript, java or mozilla, the fact is that with IE6 the problem does not appear. (but IE6 suxx :P)
Sorry, forget translation! The phrase in the java console says: Javascript: default protection policy = http://freesms.190.it Javascript: Java system code call
Andrea: thanks! Since this is a Java issue, reassigning to OJI component. cc'ing Mitch in case there are Security issues involved -
Assignee: asa → joshua.xia
Component: Browser-General → OJI
QA Contact: asa → dsirnapalli
Andrea, only members of drivers@mozilla.org may set the blocking flag to "+", so you may only set e.g. "blocking 1.3?" (with question mark) for requesting decision of drivers if this should block the 1.3 release. But since 1.3 was already released before this bug was even reported, I simply clear the flag now.
Flags: blocking1.3+
Sorry, I can't login, please let me login or provide a testcase to investigate. Thanks! This should be liveconnect 's bug if it can reproduce.
Status: UNCONFIRMED → NEW
Ever confirmed: true
Keywords: hang
Summary: Browser crashes chen submitting javascript form. → Browser hangs when checking certificate after submitting a javascript form
Could this prehaps be related to my problem? My mailapplication crashes the whole browser when started. It connects to imap.island.liu.se (and that comes up graphicly), and if I ignore the crash message I can continue browsing and/or writing mail (although no new mail are fetched) and I cannot send any mail. The same happens when I try to connect to webmail.island.li.se (I think it is using the same certificate) but then it crashes completely. I tried removing those certificates but it did not work. I am om Win98 with Pipelining enabled, could perhaps be a SSL problem? I've already tried emtying my directory and reinstalling This is a Major/Critical bug. Some of my talkback crashes.... TB20688926 TB20689117
One of two stack traces is empty; the other is occurring in Security code. I also noticed the hang Andrea analyzed in Comment #4 and Comment #5 is the same as what I found in bug 205287, "browser does not redraw when getting quote from 21st.com". There, the Java Console also shows an infinite number of security checks. See bug 205287 comment 3 and following. Reassigning this bug to the Security:General component for parity. If we duplicate, I would recommend duping to the later bug 205287 since there are more comments there -
Assignee: joshua.xia → mstoltz
Component: OJI → Security: General
QA Contact: dsirnapalli → carosendahl
*** This bug has been marked as a duplicate of 205287 ***
Status: NEW → RESOLVED
Closed: 19 years ago
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: