Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTML5 localStorage allows sites to fill up users' hard disks

feross.org

Post reply on HN
Print view View original

131–140 of 191 posts

Re: HTML5 localStorage allows sites to fill up users' hard disks

#131

Post by rplnt »

jaredsohn wrote: post #96
pilif wrote: post #50

So. The question I'm asking myself now is how to fix this. Giving .domain.com a shared quota will allow one tumblr or github pages user to monopolize all storage, effectively removing local storage for this kind of scenario (also removing it for the host which is even more annoying). A maybe workable solution would be to only allow creation of new keys for the first-party origin. What I mean is that whatever.example.…

Limit how much can be placed in localstorage regardless of site based on time. (Or perhaps prompt whenever that limit is reached, in case there is a legit reason for it.) This isn't perfect in that your localstorage could still be filled up slowly if you leave a page open in the background, but I think this solution is robust to many different techniques.

Opera has a prompt message when limit is reached (it was actually triggered on the demo page). But it only works for subdomain level. There is no global domain limit.

Re: HTML5 localStorage allows sites to fill up users' hard disks

#132

Post by daleharvey »

Tichy wrote: post #106
briansmith wrote: post #63

Earlier quoted context omitted.

Any kind of DOM storage (cookies, localStorage, IndexedDB, etc.) is ephemeral. The browser needs to decide the maximum amount of disk space that it wants to consume, and then when it hits that limit, it needs to start throwing away (garbage collecting) some of the data based on some policy like LRU. If the web app really needs permanent storage then that permanence of storage needs to be granted explicitly by the use…

I think localStorage already asks the user.

it doesnt, indexeddb and filesystem api do though

Re: HTML5 localStorage allows sites to fill up users' hard disks

#133

Post by rplnt »

DigitalSea wrote: post #38

Please sir, may I have some more? This is awesome. I got to 935mb of space used before Google Chrome on Windows 7 64bit crashed dramatically. However, good news, when I restored the tabs it resumed right where it left off filling up my hard drive.

I got to over 2GB and then Chrome crashed (not dramatically, just a tab). Fun fact is that I was not running the "exploit" in Chrome. I was testing it in Opera and I suspect that it was cheating and allocating more and more memory for all the local storage instead of dumping it out to hard drive. So system run out of memory and something had to go.. I still find it funny that it was Chrome :)

Re: HTML5 localStorage allows sites to fill up users' hard disks

#134

Post by rplnt »

okamiueru wrote: post #90

Here is how it looked in Opera: http://i.imgur.com/SOoadOB.png

That's just a bug in the exploit that it accidentally used more than 5 MB per subdomain. I got the same prompt, but when I tried to run it again in private tab and the limit was not hit. It got to over 2GB before something bad happened (Chrome's tab process crashed).

Re: HTML5 localStorage allows sites to fill up users' hard disks

#135

Post by nkuttler »

aw3c2 wrote: post #127
yaix wrote: post #77

Earlier quoted context omitted.

> Limit the total local storage space at a browser level. E.g. 1GB I wouldn't mind Google Maps to fill some 100 GiB with map data so that I can have detailed maps while I am offline in some remote African town.

You might like OpenStreetMap! You can get the whole planet in a http://planet.openstreetmap.org/planet/ Granted that is the raw data, but you can extract the regions you need easily and then render them on demand.

I don't think it's such a good idea to link directly to such huge files from here. The directory would do just fine http://planet.openstreetmap.org/planet/ and avoid bots or inattentive clicks.

But good to know anyway!

Re: HTML5 localStorage allows sites to fill up users' hard disks

#136

Post by rplnt »

yaix wrote: post #76

Just ask the user if its okay, like with geo data, translate web site, etc. "Allow example.com to track your location?" [Yes] [No] "Allow a1.example.com to store x MB of data locally?" [Yes] [No] Also > The HTML5 Web Storage standard was developed to allow sites to store larger amounts of data (like 5-10 MB) than was previously allowed by cookies (like 4KB). Main difference is that cookies are uploaded to the server…

This is what Opera does (you are prompted to raise limit) and it does not prevent this kind of attack. You still would have to have separate TLD limit.

Re: HTML5 localStorage allows sites to fill up users' hard disks

#137

Post by DigitalSea »

rplnt wrote: post #133
DigitalSea wrote: post #38

Please sir, may I have some more? This is awesome. I got to 935mb of space used before Google Chrome on Windows 7 64bit crashed dramatically. However, good news, when I restored the tabs it resumed right where it left off filling up my hard drive.

I got to over 2GB and then Chrome crashed (not dramatically, just a tab). Fun fact is that I was not running the "exploit" in Chrome. I was testing it in Opera and I suspect that it was cheating and allocating more and more memory for all the local storage instead of dumping it out to hard drive. So system run out of memory and something had to go.. I still find it funny that it was Chrome :)

Haha yeah, that is a bit strange. When Chrome crashed for me it was every process, not just the one tab which I rarely see happen these days. Lets hope the Chrome team implement a fix for this ASAP, not holding my breath on an IE fix for at least a year or so given their prior history for patching things.

Re: HTML5 localStorage allows sites to fill up users' hard disks

#138

Post by farseer »

The solution is simple but ugly:

A root domain www.example.com can utilize upto 10MB of storage while sub-domains count towards that storage limit. Any domain trying to access more will automatically result in a user prompt. An exemption can be made for domains/subdomains that present a valid SSL certificate, the whole idea is to prevent abuse.

Re: HTML5 localStorage allows sites to fill up users' hard disks

#139

Post by potkor »

pilif wrote: post #50

So. The question I'm asking myself now is how to fix this. Giving .domain.com a shared quota will allow one tumblr or github pages user to monopolize all storage, effectively removing local storage for this kind of scenario (also removing it for the host which is even more annoying). A maybe workable solution would be to only allow creation of new keys for the first-party origin. What I mean is that whatever.example.…

Maybe stop the whole thing about "let's pretend common nth level domain signifies something about web page relatioships"? It's just baseless.

Re: HTML5 localStorage allows sites to fill up users' hard disks

#140

Post by hosay123 »

DigitalSea wrote: post #38

Please sir, may I have some more? This is awesome. I got to 935mb of space used before Google Chrome on Windows 7 64bit crashed dramatically. However, good news, when I restored the tabs it resumed right where it left off filling up my hard drive.

Did it literally crash, or just hang? One joyful misfeature of LevelDB (which forms the basis of Chrome's implementation) is that when a particular write rate is exceeded for a sustained period, LevelDB will fall behind merging old segments and block hard, often for minutes on spinning rust, until it catches up.

But hey, who cares about by-design black swan latency characteristics for real world use cases when the published benchmarks look so great.

Post reply on HN