Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTML5 localStorage allows sites to fill up users' hard disks

feross.org

Post reply on HN
Print view View original

51–60 of 191 posts

Re: HTML5 localStorage allows sites to fill up users' hard disks

#51

Post by frankacter »

AdamTReineke wrote: post #42
AdamTReineke wrote: post #35

FYI, if you're on IE10, hitting the Stop button seems to throw a local storage exception and doesn't clear the space.

And if anybody knows how to reclaim that space, let me know... Clearing cache and cookies for the domain didn't work.

Clearing the Storage Areas

Session state is released as soon as the last window to reference that data is closed. However, users can clear storage areas at any time by selecting Delete Browsing History from the Tools menu in Internet Explorer, selecting the Cookies check box, and clicking OK. This clears session and local storage areas for all domains that are not in the Favorites folder and resets the storage quotas in the registry. Clear the Preserve Favorite Site Data check box to delete all storage areas, regardless of source.

http://msdn.microsoft.com/en-us/library/cc197062%28v=vs.85%2...

Re: HTML5 localStorage allows sites to fill up users' hard disks

#52

Post by eksith »

loeg wrote: post #47
eksith wrote: post #44

Well this is frightening. You don't even need to create subdomains since basically anyone with wildcard subdomains enabled can do this without a sweat. All you need is a random number generator and rewrite x.domain.com to domain.com and the browser is none the wiser. Though I can't quite imagine why anyone would want to do this to some random stranger. Unless you knew the visitor or had some means of personally ident…

Sorry, maybe this is obvious, but — how do you fill up a remote HD with just an IP and hostname with nmap and friends?

Well, I meant you can use these tools to gain access to the remote machine to do some real damage. Nmap and friends are usually for finding running services, list of open ports, knock on a few doors (run some queries?) etc... and if someone were to gain access to a machine this way, filling up their hard drive may not be on their list of priorities. Unless incrimination was the intention.

Re: HTML5 localStorage allows sites to fill up users' hard disks

#53

Post by lutze »

mablae wrote: post #8

How is that done? Isn't there a limita Limit of 5Mb(?) per Domain definend in the HTML5 Spec for LocalStorage?

Because most of the browser vendors see "standards" as more like "suggestions".

I'm sure any web developer will tell you it's been a problem from the moment there was more than one browser. This is just a particularly hilarious example.

Re: HTML5 localStorage allows sites to fill up users' hard disks

#54

Post by gordaco »

feross wrote: post #5
yefim323 wrote: post #2

I was really annoyed by the fact that the "disk filling" started as soon as I clicked the link. However, the point really hit home. Is there a solution for this browser-side? EDIT: The link has been changed to the blog post describing the phenomenon. Good riddance!

You can use Firefox. Firefox actually implements a reasonable storage limit policy for this. 10MB for an entire domain (all subdomains included)

For those interested in changing the amount of storage per domain in firefox: about:config -> dom.storage.default_quota. Also, dom.storage.enabled to change whether you use local storage at all or not. I don't know if chrome or iexplore also give those options.

It's nice that this exploit is presented openly as a proof of concept, and includes a button to undo the damage. Many people, upon finding this, would try to use it for shadier ends.

Re: HTML5 localStorage allows sites to fill up users' hard disks

#55

Post by tantalor »

Some analysis of how this works,

1. The main page contains an iframe which serves this script:

https://github.com/feross/filldisk.js/blob/master/static/fra...

2. This script writes a 2,500,000-length string to local storage, which should occupy at least 2.5Mb (probably much more). This matches the maximum storage per sub-domain.

3. This script then reloads the iframe on a different subdomain but the same script. GOTO 2.

Re: HTML5 localStorage allows sites to fill up users' hard disks

#56

Post by benatkin »

tjoff wrote: post #41
benatkin wrote: post #28

Earlier quoted context omitted.

All it takes is a redirect.

What's your point? That people can be annoying?

No, that this is a double standard people have. They gripe about any non-YouTube site playing audio, but say nothing when they click a bit.ly link that redirects to a YouTube video page.

Re: HTML5 localStorage allows sites to fill up users' hard disks

#58

Post by pilif »

mcnemesis wrote: post #27
benaiah wrote: post #13

Earlier quoted context omitted.

In Chrome, you can go to Settings->Advanced Settings->Content Settings->Cookies->All Cookies and Site Data, and it will list sites using your localStorage.

Thanks, gave me a chance to peek at which sites/apps have been running experiments on my box (web db stuf,...). The thing I still find disturbing is that unlike cookies, it seems not easy/direct to view the contents of a localstorage (other than its meta-data).

It's cumbersome, but visit the site in question and use the web inspector. The resources tab lists the various keys and values for that site.

Re: HTML5 localStorage allows sites to fill up users' hard disks

#59

Post by tantalor »

benaiah wrote: post #13
mcnemesis wrote: post #11

Is there a means to inspect (and or modify) what apps are putting into my local storage? something similar to cookie inspection?

In Chrome, you can go to Settings->Advanced Settings->Content Settings->Cookies->All Cookies and Site Data, and it will list sites using your localStorage.

Example of what this looks like, http://imgur.com/jYc0nHU

Re: HTML5 localStorage allows sites to fill up users' hard disks

#60

Post by feross »

tantalor wrote: post #55

Some analysis of how this works, 1. The main page contains an iframe which serves this script: https://github.com/feross/filldisk.js/blob/master/static/fra... 2. This script writes a 2,500,000-length string to local storage, which should occupy at least 2.5Mb (probably much more). This matches the maximum storage per sub-domain. 3. This script then reloads the iframe on a different subdomain but the same script. GOTO…

Yep, I included lots of comments in the source code so that people could check it out and learn how it works: https://github.com/feross/filldisk.js
Post reply on HN