771384 - Kuma: KumaScript - Limit number of calls to alert() allowed per template instance

Status: RESOLVED INVALID

(developer.mozilla.org Graveyard :: Wiki pages, defect)

Description

[Eric Shepherd [:sheppy]]

To prevent possible accidental denial of service incidents, we should limit how many times an alert can be presented within one instance of a template. Perhaps 3-5 to allow them to be used for debugging purposes?

Comment 1

[Les Orchard [:lorchard]]

Do you mean JavaScript alert()? Do you have an example? Don't quite understand the issue

Comment 2

[Eric Shepherd [:sheppy]]

There's no example here. I was thinking that sometimes a JS alert() call might be handy when debugging templates, but then it occurred to me that they could be used to cause some havoc, and that perhaps a limit should be enforced. This may or may not be a big deal (or even an issue at all).

Comment 3

[John Karahalis [:openjck]]

Doesn't a user need special permissions to edit templates? If that's the case, I would say it's safe to leave things as-is for now. If people abuse alert(), we could look at a blacklist or something similar.

Comment 4

[Les Orchard [:lorchard]]

But the thing is... I don't think there's a way to call alert from a kumascript template - you can't insert <script> into a page, anyway.

Comment 5

[Eric Shepherd [:sheppy]]

Yep, you're right.