Vulnerability Development mailing list archives

html input values and resource consumption


From: Xander Teunissen <Ueberschim () schimmetje com>
Date: Thu, 21 Jun 2001 04:04:44 -0700 (PDT)

Hi y'all,

I was working on a plugin thingie for a certain browser which uses some html form fields and couldn't help wondering 
about the way these get handled in memory.

More specifically, when for example a textfield gets filled out with one value or another or has one predefined, this 
obviously has to be stored somewhere, at least until the form is posted. Most browsers/email clients etc however don't 
seem to apply any limits to this value, which could potentially eat away a lot of memory. What is to stop someone from 
putting something like

<?

$i = 1;
$n = "rather bloody huge amount of data";

while ($i > 0) {

echo "<form><input type=\"text\" value=\"$n\"></form>";

}

?>

together? ("Ethics"? No such animal I'm afraid..)

If $n is sufficiently large, this eats through the available memory (and a lot of CPU cycles) way before you even start 
considering to stop the page from loading. (yeah yeah there's always someone with better reflexes, not my point here 
though :) Even though in above the fact that it's looping isn't helping either (I just wanted a quick example), the 
size of the value has a lot to say about it as well (otherwise try a lot of text boxes  with long predefined values on 
1 page instead of looping).

On my box's local webserver the memory didn't get freed from the browser process until another page was loaded or the 
browser got killed (of course if you'd want to put this in an email message php wouldn't work but surely we're creative 
enough to get past that). From a remote machine the browser process eventually seemed to consume less but the overall 
performance did go down the drain (talking MSIE5 Win2k/Solaris versions and Netscape 4 to 6 same versions here).

Riddle me how, riddle me why (or if this has already been discussed to death, humor me) , how to deal with this? (since 
none of the to me available browsers do :(  ) Is it even possible to limit this or is it just the way the 
implementation goes?

Cheers,

Xander

_____________________________________________________________
Sign up for FREE email from Schimmetje.com at http://www.schimmetje.com


Current thread: