847538 - DOS via storage limit evasion using ipv6

Status: NEW

(Core :: DOM: Core & HTML, defect, P5)

Description

[Mark Goodwin [:mgoodwin]]

The attack described here http://feross.org/fill-disk/ (and widely publicised) can also affect firefox in some circumstances. In particular, eTLD+1 limits do not apply for IP addresses, v4 or v6, the latter providing a cheap way to exhaust storage on users' machines.

This issue affect localStorage (and probably other mechanisms). It seems this possibility has already been publicly discussed in the comments of the Hacker News post discussing the original Chrome / IE / Safari vulnerability here: http://news.ycombinator.com/item?id=5297680

Comment 1

[Daniel Veditz [:dveditz]]

IMHO we should not allow permanent storage for IP addresses. Addresses should get a memory-backed version like we do in a Private Browsing context.

Comment 2

[Firefox Bug Husbandry Bot]

https://bugzilla.mozilla.org/show_bug.cgi?id=1472046

Move all DOM bugs that haven’t been updated in more than 3 years and has no one currently assigned to P5.

If you have questions, please contact :mdaly.