HTML5 localStorage allows sites to fill up users' hard disks

#1

Post by feross » Thu, Feb 28, 2013, 5:39 AM UTC

HTML5 localStorage allows sites to fill up users' hard disks
feross.org

Re: HTML5 localStorage allows sites to fill up users' hard disks

#2

Post by yefim323 » Thu, Feb 28, 2013, 5:53 AM UTC

I was really annoyed by the fact that the "disk filling" started as soon as I clicked the link. However, the point really hit home. Is there a solution for this browser-side?

EDIT: The link has been changed to the blog post describing the phenomenon. Good riddance!

Re: HTML5 localStorage allows sites to fill up users' hard disks

#3

Post by martin_ » Thu, Feb 28, 2013, 5:54 AM UTC

So apparently this is where you file IE bugs http://connect.microsoft.com/IE - i'm not sure if it's expected or ironic that it's broken. Great find btw!

Re: HTML5 localStorage allows sites to fill up users' hard disks

#4

Post by muglug » Thu, Feb 28, 2013, 5:57 AM UTC

Mitigation: there's an option in chrome://flags that converts all these images to dog pictures.

Re: HTML5 localStorage allows sites to fill up users' hard disks

#5

Post by feross » Thu, Feb 28, 2013, 5:58 AM UTC

yefim323 wrote: post #2

I was really annoyed by the fact that the "disk filling" started as soon as I clicked the link. However, the point really hit home. Is there a solution for this browser-side? EDIT: The link has been changed to the blog post describing the phenomenon. Good riddance!

You can use Firefox. Firefox actually implements a reasonable storage limit policy for this. 10MB for an entire domain (all subdomains included)

Re: HTML5 localStorage allows sites to fill up users' hard disks

#6

Post by jiggy2011 » Thu, Feb 28, 2013, 6:01 AM UTC

Got to ~800MB and then chrome crashes.

Re: HTML5 localStorage allows sites to fill up users' hard disks

#7

Post by dragontamer » Thu, Feb 28, 2013, 6:02 AM UTC

feross wrote: post #5

yefim323 wrote: post #2

I was really annoyed by the fact that the "disk filling" started as soon as I clicked the link. However, the point really hit home. Is there a solution for this browser-side? EDIT: The link has been changed to the blog post describing the phenomenon. Good riddance!

You can use Firefox. Firefox actually implements a reasonable storage limit policy for this. 10MB for an entire domain (all subdomains included)

I was wondering why it wasn't working, lol. Got stuck at 5MB for me.

Re: HTML5 localStorage allows sites to fill up users' hard disks

#8

Post by mablae » Thu, Feb 28, 2013, 6:14 AM UTC

How is that done?

Isn't there a limita Limit of 5Mb(?) per Domain definend in the HTML5 Spec for LocalStorage?

Re: HTML5 localStorage allows sites to fill up users' hard disks

#9

Post by iProject » Thu, Feb 28, 2013, 6:16 AM UTC

mablae wrote: post #8

How is that done? Isn't there a limita Limit of 5Mb(?) per Domain definend in the HTML5 Spec for LocalStorage?

per SUBdomain. So just use:

example.com

1.example.com

2.example.com

...

Re: HTML5 localStorage allows sites to fill up users' hard disks

#10

Post by kevincrane » Thu, Feb 28, 2013, 6:16 AM UTC

mablae wrote: post #8

How is that done? Isn't there a limita Limit of 5Mb(?) per Domain definend in the HTML5 Spec for LocalStorage?

http://feross.org/fill-disk/

He explains here that most browsers (except Firefox) don't follow the standard close enough, and ignore the exception for subdomains, i.e. 1.filldisk.com, 2.filldisk.com, etc.