5

Well it's not some huge security risk, though it reveals some potential interference at least.

Suppose we have those very well closed JavaScript modules that is loaded into my page without knowing about each other. They are from "trusted" however some developer in lib2 made a mistake, see the code.

Lib1 http://good.site/libs/the-famous-important-lib1.js

setInterval(function(){
   alert('I am doing some important stuff');
}, 1000);

Lib2 http://not-excelent.site/libs/the-cool-lib2.js

var i = setInterval(function(){}, 0);
for(; i >= 0; i-=1) {
    clearInterval(i);
}

My Html

<script src="http://good.site/libs/the-famous-important-lib1.js" type="text/javascript"></script>
<script src="http://not-excelent.site/libs/the-cool-lib2.js" type="text/javascript"></script>

In a browser or at least on Firefox, Loading Lib2 would actually break Lib1 totally. Some might say this is not important, and how silly to make such mistake.

I consider that as a bad behavior. Since we are loading more and more 3rd party libs in our websites. Maybe a proper solution is that setInterval, and setTimeout should return an Ojbect to be really unique and un-fakable, instead of just numeric auto increment ID.

Someone might cam up with a real-world exploitation for this (still didn't test if it is cross frames, I doubt it really).

The question is: Is it? and Does strict mode in es5 overcomes that?

5
  • 1
    clearing others' setIntervals? Sure it'll break things, but nothing catastrophic can happen. Jan 12, 2012 at 9:21
  • easy solution.. don't use other peoples rubbish code ;)
    – musefan
    Jan 12, 2012 at 9:24
  • 3
    @SergioTulentsev I have however seen a website whose paywall is triggered by a setTimeout(). If that timer is cleared, non-paying customers don't get thrown out. Utterly lousy security design...
    – Alnitak
    Jan 12, 2012 at 9:26
  • 3
    I don't think it is a security vulnerability here. It is a developer responsibility to test scripts he use. Allowing malicious scripts to be executed is a vulnerability, but is is another story.
    – Andrey M.
    Jan 12, 2012 at 11:08
  • @AndreyM. Really? I don't think anyone who read the whole code Facebook SDK or Google Maps before using it. And those people using really advanced techniques to take as much as they can from the browser, so when you load a 3rd party lib you just accept lots of risks. At least I do. Jan 12, 2012 at 16:14

2 Answers 2

3

Does strict mode in es5 overcomes that?

No. setInterval and setTimeout are part of the DOM bindings -- they are not EcmaScript builtins so are not specified in any version of EcmaScript. Nothing in strict mode specifically affects them.

This will probably change in the next version of EcmaScript since the TC39 committee thinks that concurrency is a core language feature that needs to be specified and will probably retain event loop concurrency.

Those changes are unlikely to affect the problem you raise though. Caja / Secure EcmaScript (SES) does make sure that interval and timeout ids are not guessable.

3

Interesting point.

Since interval/timeout ids are sequential, you can (as you've shown us) clear all intervals/timeouts by getting yourself next interval id, and than trying to clear any ids lower than one you got.

However, I don't see any security threat there. Any web application, that would base their security solely on interval and/or timeout in Javascript is as good as hacked anyway.

As Sergio Tulentsev already commented - abusing clearInterval/clearTimeout is going to break things - for sure - but (99% of the time) that won't pose any security threat for web application.

1
  • 1
    I was talking about language safety and security not just application security, since when we spend lots of time hiding our modules inside closures (which is good), and we have invited the "strict mode". JavaScript should avoid such silly breaking points, though I know that's it's complicated to achieve since it's JavaScript and there lots of people involved. Jan 12, 2012 at 16:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.