249360 - No way to stop malicious javascript

Status: VERIFIED DUPLICATE of bug 61098

(Core :: DOM: Core & HTML, defect)

Description

[Max Alekseyev]

Linux build 2004062507

To reproduce:
1. Open the provided testcase
2. There is no way to stop malicious javascript
The only way to stop it, is to kill mozilla-bin application

Expected results:
There should be a way to interrupt javascript execution without killing Mozilla.

Comment 1

[Max Alekseyev]

Attachment: Testcase

Comment 2

[timeless]

steps:
1. open a second window
2. load your link in the first window
3. select the second window
4. tools>web development>javascript debugger
5. select the windows view
6. select the first window
7. select the evil page
8. double click
9. set a breakpoint on the first while(true) line
10. click ok in the stupid dialog
11. in venkman evaluate: alert=funciton die(){throw 'stop that'}
12. click the green continue button.

-done-

what these steps mean: the summary is wrong.

Comment 3

[Bryan]

Hi,
Netscape Communicator 4.79 Internet Explorer 5.01 anmd 5.5 Other Mozilla
versions and Opera 7.51 paid version do the same.
I think that it is a thing of all browsers.

Comment 4

[Brendan Eich [:brendan]]

If you wait long enough, a dialog asking whether to stop the script or let it
continue should come up.

/be

Comment 5

[Max Alekseyev]

> steps:
> 1. open a second window
> 2. load your link in the first window

Nice ;)

But what if only one window was opened, and the script run there?
It will block openning a second window.

Comment 6

[Max Alekseyev]

Brendan, is there a way to force termination of the script not "waiting long
enough" ?
I'd prefer to have, say, a checkbox like 
[ ] Terminate this javascript
right on the annoying dialog.

Comment 7

[Nicholas Allen]

relf-

You probably want bug bug 61098.

This is a different DOS attack than the script blocker is designed for.  There
is no runaway script, it is patiently waiting for the user's input.  Past dupes
of this (such as bug 66097) went to bug 61098.  bug 59314 and bug 60150 may be
other approaches to tackle the problem.

Comment 8

[Jesse Ruderman]

*** This bug has been marked as a duplicate of 61098 ***