Closed Bug 598226 Opened 11 years ago Closed 3 years ago

bug 61098 fix should be non trappable with try{}catch(){}

Categories

(Core :: DOM: Core & HTML, defect, P3)

defect

Tracking

()

RESOLVED FIXED
Tracking Status
blocking2.0 --- -

People

(Reporter: BijuMailList, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: sec-want, Whiteboard: [sg:want])

Attachments

(1 file)

Attached file alert_trap.html
bug 61098 fix should be non trappable with try{}catch(){} 

Otherwise user will have to wait till "script taking too long" to stop the run away script.

Again if user accidentally pressed continue he will be stuck again.

See attachment alert_trap.html
Essentially this is asking to stop script execution on the page, I seem to recall a bug out there for this already although I don't have the number offhand.

I highly doubt this will block at this point though...
Whiteboard: dupeme
Nope, not blocking. The point in bug 61098 was to give people 'a' way out, but given the extremely rare occurrences of these problems (I've personally never run into one randomly) I don't think it's worth investing much time in making it the smoothest experience possible. Time may of course change that, but for now I don't see a need to do anything beyond what we've done for Firefox 4.
blocking2.0: ? → -
status2.0: ? → ---
Blocks: eviltraps
(In reply to comment #1)
> Essentially this is asking to stop script execution on the page

No, just immediately return from the function without throwing. The page doesn't need to know that you've disabled their prompts, just act like the user immediately hit Esc.

(In reply to comment #2)
> given the extremely rare occurrences of these problems (I've personally never
> run into one randomly) I don't think it's worth investing much time in making
> it the smoothest experience possible.

You've been lucky, or you stick to the well-maintained, well-financed big sites on the web. In the sketchier parts sites get hacked all the time, and this is a common approach for miscreants who don't have an outright 0-day to infect you with.
Whiteboard: dupeme → [sg:want]
(In reply to comment #4)
> (In reply to comment #1)
> > Essentially this is asking to stop script execution on the page
> 
> No, just immediately return from the function without throwing. The page
> doesn't need to know that you've disabled their prompts, just act like the user
> immediately hit Esc.

I don't really understand this, that would still be a runaway js loop. Stopping js execution would return control to the user.
The provided tests no longer work. The checkbox stops the repeated alert or prompt.
Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.