Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

default browser coutermeasure doesn't crash the browser.. #102

Open
mini-programmer opened this issue Jul 6, 2023 · 4 comments
Open

default browser coutermeasure doesn't crash the browser.. #102

mini-programmer opened this issue Jul 6, 2023 · 4 comments
Labels
enhancement New feature or request

Comments

@mini-programmer
Copy link

I'm not really sure if this should be a feature request or issue
When it's supposed to "crash the process" on browser, all it does it run document.documentElement.innerHTML = ''; which doesn't crash anything
maybe it could run an infinite loop to actually crash? like for(;;){while(1){}}

@mini-programmer mini-programmer added the enhancement New feature or request label Jul 6, 2023
@MichaelXF
Copy link
Owner

You are right. The new behavior will just be an infinite loop as the default countermeasure. I will change this for next update.

@Le0Developer
Copy link

Le0Developer commented Jul 9, 2023

An infinite loop can be easily stopped by just pressing the "Pause script execution" button in devtools.
There are better ways to crash a tab like spamming iframes. (this absolutely kills devtools if it runs for a few seconds)

for(;;) {
    let a = document.createElement("iframe");
    a.src = "data:,"
    document.body.append(a)
}

EDIT: edited to replace "/" with data:,, so it doesnt dos your webserver. Lot more effective now too.

@fuzzbuck
Copy link

Maybe the countermeasure should be configurable?

Some may want to just pause script execution, and others crash the page..

@MichaelXF
Copy link
Owner

@fuzzbuck The countermeasures is configurable by setting it a string, it can be a custom callback. This issue is related to the default behavior (no value provided) is incorrect. I like @Le0Developer 's code snippet and it will be the default behavior

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

4 participants