I remember back in the old days (Netscape was king!) when learning JavaScript that it was pretty easy to lock up the browser with the Alert statement. All you had to do was create an infinite loop of JavaScript alerts and then the browser was essentially locked up.
So while this typically only happens to poor developers who do it to themselves (as I did a few days ago), why haven't the browser makers done anything about this? Is it really something that only affects us doing development? While I'm not quite sure what the UI would be - it seems like something that could be solved. Perhaps the browser could simply keep an internal counter of the number of alerts fired. Once it hits 30, simply put a prompt on the alert asking if the user would like to suppress all future alerts.
Archived Comments
You know what is interesting about this, is that browsers already do have the functionality to allow you to abort long running JavaScript or Flash operations. It detects infinite loops and allows you to stop the script. I have a feeling, however, that the Alert issue is not caught in this because it contains visual feedback to the user. The only time I have seen the former occur is when the script was looping and no visual feedback to this loop was provided.
True. And yet we don't see exploits. "Any site can crash your browser!" seems like it would make a good security headline on a slow news day...?
Opera has a toggle on Javascript alerts for "Stop scripts for executing on this page" (or something to that effect.)
Brian, nice to know _someone_ got it right (although I've never tried Opera myself.)
John, I'm not quite sure this would be a security issue per se. I mean, it can lock you out of your browser and force you to shut it down but it can't really (afaik) steal any information from you.
Is there a more graceful way to handle alerts then, that doesn't prevent you from interacting with the browser until you confirm?
Maybe it pops open a toolbar at the top of the page along the lines of IE's "blocked content" message and Firefox's "install plug-in"...just more noticeable.
You could then have optional "traditional" alerts for times when you want to prevent the user from accessing the browser until they confirm. Such as: alert("message","strict") or alert("message","soft")
Or, how about simply putting to use the good old "break" key? After all, what is it there for anymore?
There has got to be some sort of shortcut way to cancel a script from within a series of alert messages.
This is an old thread and new solutions may have been implemented -- though I haven't heard of any. But anyway, I just wanted to share the following trick that I'm using to get rid of a perpetual alert() on FireFox:
just press and hold Ctrl+F4 on the keyboard, then use the mouse to click the "OK" button of the modal box. A last alert() may be fired, but the current tab should be closed.
(Note that it was only tested on FireFox 3.)