Raymond Camden's ColdFusion Blog: Alert can still lock browsers

Alert can still lock browsers - why?

I remember back in the old days (Netscape was king!) when learning JavaScript that it was pretty easy to lock up the browser with the Alert statement. All you had to do was create an infinite loop of JavaScript alerts and then the browser was essentially locked up.

So while this typically only happens to poor developers who do it to themselves (as I did a few days ago), why haven't the browser makers done anything about this? Is it really something that only affects us doing development? While I'm not quite sure what the UI would be - it seems like something that could be solved. Perhaps the browser could simply keep an internal counter of the number of alerts fired. Once it hits 30, simply put a prompt on the alert asking if the user would like to suppress all future alerts.

This entry was posted on Sunday, January 7, 2007 at 12:18 PM. It was filed in the following categories: JavaScript. It has been viewed 3,103 times and has 8 comments.

TweetBacks

Comments

[Add Comment] [Subscribe to Comments]

Comment 1 written by Kyle Hayes on 7 January 2007, at 12:27 PM

You know what is interesting about this, is that browsers already do have the functionality to allow you to abort long running JavaScript or Flash operations. It detects infinite loops and allows you to stop the script. I have a feeling, however, that the Alert issue is not caught in this because it contains visual feedback to the user. The only time I have seen the former occur is when the script was looping and no visual feedback to this loop was provided.
Comment 2 written by John Dowdell on 7 January 2007, at 5:44 PM

True. And yet we don't see exploits. "Any site can crash your browser!" seems like it would make a good security headline on a slow news day...?
Comment 3 written by Brian on 7 January 2007, at 7:48 PM

Opera has a toggle on Javascript alerts for "Stop scripts for executing on this page" (or something to that effect.)
Comment 4 written by Raymond Camden on 7 January 2007, at 9:32 PM

Brian, nice to know _someone_ got it right (although I've never tried Opera myself.)
Comment 5 written by Raymond Camden on 7 January 2007, at 9:34 PM

John, I'm not quite sure this would be a security issue per se. I mean, it can lock you out of your browser and force you to shut it down but it can't really (afaik) steal any information from you.
Comment 6 written by PaulC on 8 January 2007, at 8:48 AM

Is there a more graceful way to handle alerts then, that doesn't prevent you from interacting with the browser until you confirm?

Maybe it pops open a toolbar at the top of the page along the lines of IE's "blocked content" message and Firefox's "install plug-in"...just more noticeable.

You could then have optional "traditional" alerts for times when you want to prevent the user from accessing the browser until they confirm. Such as: alert("message","strict") or alert("message","soft")
Comment 7 written by David L. Burkhart on 14 February 2008, at 2:49 PM

Or, how about simply putting to use the good old "break" key? After all, what is it there for anymore?

There has got to be some sort of shortcut way to cancel a script from within a series of alert messages.
Comment 8 written by Arnauld Chevallier on 18 November 2008, at 11:25 AM

This is an old thread and new solutions may have been implemented -- though I haven't heard of any. But anyway, I just wanted to share the following trick that I'm using to get rid of a perpetual alert() on FireFox:

just press and hold Ctrl+F4 on the keyboard, then use the mouse to click the "OK" button of the modal box. A last alert() may be fired, but the current tab should be closed.

(Note that it was only tested on FireFox 3.)