Comments on: A JavaScript DOS Attack

By: clamshell

clamshell — Tue, 17 Nov 2009 13:49:01 +0000

Hmmm, it seems that in two years, this is still a problem in Firefox 3.5.

Another problem, on Windows XP, at least, is that this alert box officially makes it responsive, which means you can’t just click on the ‘X’ and let windows ask you to close it, you actually have to go into Task Manager, etc…

There is a Firefox add-on called “Session Manager” which, in addition to a number of other features, allows you to choose which pages are to be reloaded when the session is restored.

By: genius

genius — Thu, 04 Jun 2009 18:34:33 +0000

var x=0;
while(1)
{
alert(“DOS”);
}

By: sampablokuper

sampablokuper — Mon, 27 Apr 2009 13:40:28 +0000

Good post. I’m surprised more browser developers haven’t implemented a feature to stop this. I’ll be trying out the FireFox plugin shortly!

By: anonymous

anonymous — Wed, 18 Mar 2009 22:28:52 +0000

This addon for Firefox adds the ability to double-click the alert’s icon and leave the page. This prevents the page from freezing up the browser:

https://addons.mozilla.org/en-US/firefox/addon/10422

By: Christofer Abrahamsson

Christofer Abrahamsson — Mon, 17 Nov 2008 18:15:01 +0000

Do this javascript have any future? I don’t think vhost or dedicated dos is an bigger deal today.

By: Amitabh

Amitabh — Thu, 12 Jun 2008 00:00:33 +0000

ya noscript, although useful can be quite annoying.. I repeatedly enable it (after becoming paranoid about JS attacks) only to disable it few days later due to the extreme annoyance..

A “stop executing javascript” on tab (and globally) is an essential feature / add on. I’m also no browser developer.. but it appears quite doable, especially since Opera got it.

By: Guy

Guy — Sat, 22 Mar 2008 08:30:37 +0000

Hi Viet,
There is a firefox extension called NoScript that blocks anything that runs on the client-side until you specifically allow it (white-list). While it helps prevent many JS related issues, in my opinion it’s a bit too harsh for most users.

By: Viet

Viet — Sat, 22 Mar 2008 05:33:00 +0000

Hey,

Thanks for the tip. In fact JS code is not verified until run. Do you know any Firefox add-on to prevent malicious JS snippets?

By: Guy

Guy — Thu, 29 Nov 2007 05:41:09 +0000

I wish Firefox would have such feature. The way opera does it (as you describe) sound too me like the perfect solution for this problem.

By: AssistantX

AssistantX — Thu, 29 Nov 2007 05:38:15 +0000

Opera won’t have this problem. On a Javascript alert, users can select “Stop Executing Javascript on This Page” and it will break the loop.