Proxies and proto; cyclic now possible
I too had a horrible idea which can DDOS Firefox or hangs your tab in IE:
while (true) { }
On 12/8/14, 4:24 PM, François REMY wrote:
var o = {}; var p = new Proxy(o, { get: function(o, p) { return o[p]; } }); o.__proto__ = p;
This does nothing on its own in Firefox, afaict.
If I then do "o.foo" I get a "too much recursion" exception, as expected.
What is the problem, exactly?
See also ecmascript#2437
But as Domenic pointed out, there is nothing new under the sun.
± > var o = {}; ± > var p = new Proxy(o, { get: function(o, p) { return o[p]; } }); ± > o.proto = p; ± ± This does nothing on its own in Firefox, afaict. ± If I then do "o.foo" I get a "too much recursion" exception, as expected. ± ± What is the problem, exactly?
I typed the line one by one in the console, that's why. There must be something wrong with the console, then.
± I too had a horrible idea which can DDOS Firefox or hangs your tab in IE:
±
± js ± while (true) { } ±
Sure, you can also do that; but you have the control of what's going on in this case. What I find strange is that we don't allow "o.proto = o" but we accept the Proxy thing. So people may not even know this is possible, and may forget to protect themselves against it.
± See also: ± ecmascript#2437
Great, that's what I was thinking about. I shared the same concern as Allen about involuntary while loop of prototype cascade that would never return to the user code and would never stop at all. But if UA are aware of the situation and took action, that should be fine I agree. I just wanted to be sure it's the case. It seems Firefox's console didn't get the message but Firefox itself seems to handle this fine.
IE doesn't do as well as Firefox since it never recover the tab; but then again this is not different from a while(true) loop.
Best , François
François REMY wrote:
I typed the line one by one in the console, that's why. There must be something wrong with the console, then.
Please file a bug.
When I originated __proto__ in SpiderMonkey in the '90s, I added cycle
detection. It was prompt.
On 12/8/14, 6:24 PM, François REMY wrote:
I typed the line one by one in the console, that's why. There must be something wrong with the console, then.
The console may be trying to show the resulting object, yes.
I filed bugzilla.mozilla.org/show_bug.cgi?id=1108895 to track this.
Great, that's what I was thinking about. I shared the same concern as Allen about involuntary while loop of prototype cascade that would never return to the user code and would never stop at all. But if UA are aware of the situation and took action, that should be fine I agree. I just wanted to be sure it's the case. It seems Firefox's console didn't get the message but Firefox itself seems to handle this fine.
Not quite, see bug report.
I just had an horrible idea which can DDOS Firefox or hangs your tab in IE:
var o = {}; var p = new Proxy(o, { get: function(o, p) { return o[p]; } }); o.__proto__ = p;This works because of the cycle detection for setting prototypes. Should it?
Hi, I just had an horrible idea which can DDOS Firefox or hangs your tab in IE: var o = {}; var p = new Proxy(o, { get: function(o, p) { return o[p]; } }); o.__proto__ = p; This works because of the cycle detection for setting prototypes. Should it? Best regards, François __________________________ PS: I know you could get the same behavior with a proto having a reference to itself via a global variable, but in this case the proxy looks fine, and the exploitation comes from a code he can’t control. -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://mail.mozilla.org/pipermail/es-discuss/attachments/20141208/eddc6079/attachment.html>