HTML5 Storage Bug Can Fill Your Hard Drive 199
Dystopian Rebel writes "A Stanford comp-sci student has found a serious bug in Chromium, Safari, Opera, and MSIE. Feross Aboukhadijeh has demonstrated that these browsers allow unbounded local storage. 'The HTML5 Web Storage standard was developed to allow sites to store larger amounts of data (like 5-10 MB) than was previously allowed by cookies (like 4KB). ... The current limits are: 2.5 MB per origin in Google Chrome, 5 MB per origin in Mozilla Firefox and Opera, 10 MB per origin in Internet Explorer. However, what if we get clever and make lots of subdomains like 1.filldisk.com, 2.filldisk.com, 3.filldisk.com, and so on? Should each subdomain get 5MB of space? The standard says no. ... However, Chrome, Safari, and IE currently do not implement any such "affiliated site" storage limit.' Aboukhadijeh has logged the bug with Chromium and Apple, but couldn't do so for MSIE because 'the page is broken" (see http://connect.microsoft.com/IE). Oops. Firefox's implementation of HTML5 local storage is not vulnerable to this exploit."
I wonder how fast I can fill my harddisk... (Score:2, Funny)
This sounds like a nice weekend project, wonder how fast you can fill up a harddisk with just some javascript.
Support response (Score:2, Funny)
but couldn't do so for MSIE because 'the page is broken" (see http://connect.microsoft.com/IE [microsoft.com]). Oops
FUD! We haven't recieved a complaint yet.
Yours truely,
MS support.
Re:So What's The Point (Score:2, Funny)
And those ads will be from Western Digital, Toshiba and Seagate.
Re:So What's The Point (Score:2, Funny)
And the impact to the victim? Not really a big problem.
Assume this happens to a typical Microsoft Surface user.
How long will it take, and what is the consequence? What will they need to do to recover?