Wouldn't this have earned the guy a $60,000 Chrome bug bounty if he had reported it through the right channels?
It isn't a bug.
Leads to Chrome crashing after filling up a users hard disk. That's a big bug.
HTML5 localStorage allows sites to fill up users' hard disks
121–130 of 191 posts
Re: HTML5 localStorage allows sites to fill up users' hard disks
#122This could be quite a problem for users of SSDs who lack TRIM support.
IIRC Apple were selling mac book airs with no trim support if the user didn't pay to upgrade OSX.
If a malicious user felt so inclined they could with just a few domains create a bit of a write load that would quickly fragment and hurt the performance of the SSD.
Re: HTML5 localStorage allows sites to fill up users' hard disks
#123Earlier quoted context omitted.
Prompt is the best solution to this. There's a prompt with flash.
Prompt is a horrible solution from a UX perspective. Essentially you're asking the user a question you, as a developer, couldn't or didn't want to answer. But the user has no idea either. Heck, she doesn't even know that there are limits in place or what DOM local storage even is.
I don't think it's a problem of the developer not knowing, they generally do know how much storage they'll need (or at least put an upper limit). It's a problem of trust.
Maybe the dev things they'll need 1GB but I'm not ready to give them that. The same way the apps asks for certain privileges when you install an app on, say, android.
I wonder why anybody thought it was a good idea to let any web page store some random stuff on my computer. Cookies were bad enough already.
You know, you can say what you want about Flash, but I least I could block it. These days I can't browse half the web if I disable javascript. One of these days I'll just run my browser with a separate UID just so I can keep it under control. Or better yet, a VM, since it appears people want to turn the browser into an OS anyway.
Re: HTML5 localStorage allows sites to fill up users' hard disks
#124So. The question I'm asking myself now is how to fix this. Giving .domain.com a shared quota will allow one tumblr or github pages user to monopolize all storage, effectively removing local storage for this kind of scenario (also removing it for the host which is even more annoying). A maybe workable solution would be to only allow creation of new keys for the first-party origin. What I mean is that whatever.example.…
What does Firefox currently do?
Re: HTML5 localStorage allows sites to fill up users' hard disks
#125[deleted]
Re: HTML5 localStorage allows sites to fill up users' hard disks
#126Earlier quoted context omitted.
Prompt is the best solution to this. There's a prompt with flash.
Prompt is a horrible solution from a UX perspective. Essentially you're asking the user a question you, as a developer, couldn't or didn't want to answer. But the user has no idea either. Heck, she doesn't even know that there are limits in place or what DOM local storage even is.
I'd argue that a user generally has an idea that there is a persistent storage ("disk") locally held in their computer and that they have a good idea whether they want a website to use that space or not.
The developer lacks the knowledge of the users requirements, that is why they can't answer the question. For "power users" the user is far better placed than the developer to answer the question about how much local storage space is used.
For a naive user the question comes down to "this website wants to put stuff on your computer, do you think your interaction with the website warrants them doing this", that's more a question of value of the website to the user than it is a technical question.
Re: HTML5 localStorage allows sites to fill up users' hard disks
#127Earlier quoted context omitted.
Limit the total local storage space at a browser level. E.g. 1GB. Just like you might limit the total size of temporary internet files/cache. Beyond that, just provide a good (simple) UI for deleting stuff. Which could suggest candidates for deletion based on heuristics like you suggest. E.g. iframes shouldn't need so much. Hopefully less visited sites would be suggested for deletion too.
> Limit the total local storage space at a browser level. E.g. 1GB I wouldn't mind Google Maps to fill some 100 GiB with map data so that I can have detailed maps while I am offline in some remote African town.
You might like OpenStreetMap! You can get the whole planet in a http://planet.openstreetmap.org/planet/
Granted that is the raw data, but you can extract the regions you need easily and then render them on demand.
Re: HTML5 localStorage allows sites to fill up users' hard disks
#128Is there a bug logged with Mozilla?
Firefox isn't vulnerable to this.
Re: HTML5 localStorage allows sites to fill up users' hard disks
#129So apparently this is where you file IE bugs http://connect.microsoft.com/IE - i'm not sure if it's expected or ironic that it's broken. Great find btw!
If you are signed in with a Microsoft account everything seems to work. Terrible UX though. Nothing indicates you need to sign in.
Re: HTML5 localStorage allows sites to fill up users' hard disks
#130So. The question I'm asking myself now is how to fix this. Giving .domain.com a shared quota will allow one tumblr or github pages user to monopolize all storage, effectively removing local storage for this kind of scenario (also removing it for the host which is even more annoying). A maybe workable solution would be to only allow creation of new keys for the first-party origin. What I mean is that whatever.example.…
5MB per subdomain, 100MB per domain, configurable limits, prompt when a site/subdomain requires more.
The 100MB per domain includes the subdomain storage? Then it doesn't solve what parent comment described - few subdomains could use up all the storage. If it doesn't include it and it's separate then it is exactly like it is now.