20 ms·
Favicon bug
- inglor 11y agoI'm the author of the GH repo and I just want to give full credit for figuring out Chrome does this to this guy: https://twitter.com/a_de_pasquale https://twitter.com/a_de_pasquale All I did was think "if it works for 65mb why not more?" and write a quick proof of concept. Gets to 10gb on my 4gig laptop and then crashes. (MBA, OSX 10.10).
- 0x0 11y agoWow, the twitter replies suggesting this was an accidental "tar cvf * backup.tar" sound right on the mark. Especially considering favicon.ico is probably the first file in a wp install, alphabetically.
- s_kilk 11y agoThis is my new favorite bug/mistake. It's just exquisite.
- jfb 11y agoIt really has it all, doesn't it?
- aw3c2 11y agoFor everyone struggling with tar, please be aware that you can use long-form arguments. So instead of "tar cvf filename files" you use "tar --create --verbose --file file.tar files" or maybe another order like ""tar --create --file file.tar --verbose files"- It is much more sensible and intuitive.
- andrepd 11y agoOnce you've used it more than once or twice, however, you will find that writing cfv is much more convenient than typing --create --verbose --file every time you want to tar something.
- sp332 11y agoBut if it's code you're only writing once - like in a script - you might consider using the longer ones to avoid screw ups and improve maintainability.
- tomphoolery 11y agoalways use long form flags when writing scripts...have some consideration for the person who has to fix your code when you move on
- icc97 11y agothere's an xkcd for that...: https://xkcd.com/1168/ https://xkcd.com/1168/
- aw3c2 11y agoI doubt that the creator or the promoters of the meme know about the long-form parameters. They make sense.
- inglor 11y agoWow, deeply impressed with Firefox who rolled a fix in 3 hours. Mad props.
- gtk40 11y agoHow do other browsers behave?
- inglor 11y agoFirefox doesn't behave too well either. Gets to 23169 in the counter http://i.imgur.com/3zkPKD7.png http://i.imgur.com/3zkPKD7.png
- moskie 11y agoSo why single out Chrome in this repository and post? Feels like a hit piece on Chrome this way.
- inglor 11y agoWell, I didn't really consider Firefox and I didn't want to publish anything unsubstantiated about it. No intent to single out or attack Chrome - I've changed the title to clarify that now that I have evidence this works in FF.
- txru 11y agoWell, Chrome is a very commonly used browser, and I would guess that other browsers look to it for guidance on features. Also, it seems to me that the post is only a proof of concept. "Hey, look at what happens here in this browser. I've extensively proven that it's possible. Maybe people should check it out under other circumstances."
- ecdavis 11y agoInvestigating and reporting a bug should never be considered "singling out" of a piece of software. Personally, I'd be grateful if someone pointed out a critical issue like this in my code. It means I have the opportunity to fix it!
- yincrash 11y agoWhat prevents someone from doing this with a 1 px junk image that is many GB large? edit: to clarify, i'm talking about in the page itself rather than the favicon.
- smhenderson 11y agoJust a couple of off the cuff thoughts on that. Nothing out of the box prevents what you describe as far as I know but one of the points made in the article is that favicon is downloaded without any update to or indication from the status bar. An image on the page will at least throw up a "waiting for evil.com" in the status bar giving a user some indication that something being downloaded is causing a major slow down. Typically an ad-blocker or script blocker can be used to prevent the image from downloading. But I don't know of a blocker add-on that worries about favicon. Overall while annoying and a bit strange that this wasn't anticipated and fixed long ago I'd say this is probably a non-issue. As another poster said I don't see a payoff here so I doubt it will be actively exploited in some "internet screeching to a halt" kind of way.
- stock_toaster 11y ago> Overall while annoying and a bit strange that this wasn't anticipated and fixed long ago I'd say this is probably a non-issue. As another poster said I don't see a payoff here so I doubt it will be actively exploited in some "internet screeching to a halt" kind of way. favicons can also be inserted dynamically. http://stackoverflow.com/questions/260857/changing-website-favicon-dynamically/260876#260876 http://stackoverflow.com/questions/260857/changing-website-f... If some site has a js injection bug, or there is someone doing MiTM like the Great Firewall, I suppose they could inject a favicon link that referenced some location on another site, with the intent towards DoS.
- smhenderson 11y agoWell I don't disagree but on the other hand the article is focused on what it does to a client so I wasn't thinking it through the way you are. It also occurs to me that given the ability to insert yourself between the client and the server has to open up a number of possible attack vectors that are more worth while than crashing the client. I get (I think) the point about if censorship is the goal this is a way to make clients stay away from a particular server but if you're in a position to MITM them why not just return 404's and be done with it? Not trying to argue, :-) Just want to make sure I'm understanding your point correctly...
- tomswartz07 11y agoThis seems like an active exploit, as pointed out in the OP's inspiration Twitter post. `tar` up an entire WordPress install, save it as `favicon.ico` and then easily pull the files from the server. This would be a good idea to get fixed very soon, I would assume. EDIT: I stand corrected in terms of exploit-ability, but I still assert that crashing a browser and chewing tons of bandwidth are pretty big issues.
- Someone1234 11y agoWhatever that website is, has an issue, since that backup.tar may contain their database credentials. The favicon thing is just an annoying browser crashing bug. You could call that an "exploit" but up until fairly recently you were able to crash many browsers by generating too many message boxes (e.g. alert()) asynchronously. So while, yes, it would be nice to fix it I don't really see it as being a high priority or one which will be actively exploited (since there is no "payoff" to either prankers or bad guys to this exploit).
- inglor 11y agoEating users' bandwidth has its uses as well as filling up a network with communication. This works with JavaScript disabled too but yeah I agree it's not a huge priority.
- rlemon 11y agoI know for a fact that eating mobile bandwidth would be a huge priority for some (as far as getting it fixed). For example; I live in Canada and my mobile plan is only for 8gb. If I go over I have to pay a premium, and it is not a cheap premium. I don't think unlimited bandwidth on mobile is popular (at least here, I suspect other places cough India cough) as well.
- Someone1234 11y agoEven if you cap favicon size you don't solve the issue you're discussing at all. A bad actor web-site can just move from favicon to an image, script file, or just return an indefinite series of HTML characters with no end. The only way for the issue you want solved to be solved is for mobile browsers to add a "max page size" option, that will stop downloading content after it hits the cap. In general this favicon bug is neither here nor there with the issue you're concerned about. Nobody needs this to waste your bandwidth. The only reason this is noteworthy is that it is a little embarrassing for the browser vendors and it causes the browsers (Firefox and Chrome) to crash.
- deleted 11y ago[deleted]
- Someone1234 11y agoJust doing some quick back of napkin maths, even assuming Apple's 128x128 app icons, and 48 bit colors (32 is more typical), we're still talking about a sub-100 kb max for a favicon. So if Chrome set it even at 20 Mb that would still be orders of magnitude more than any favicon should be for at least the next five or so years (even assuming 256x256 became common for app icons).
- miahi 11y agoYou can have animated favicons.
- tomswartz07 11y agoEven still, the animated favicons would be low framerate and fairly low resolution. I don't think we're ready for 60 FPS .gifv favicons just yet. :)
- daurnimator 11y agohttp://lab.ejci.net/favico.js/ http://lab.ejci.net/favico.js/
- logicallee 11y agoten gigabytes is a helluva favicon animation... I wonder if it would be measured in hours, days, or weeks...
- Johnny_Brahms 11y agoLet's go ahead and implement webm favicons. Months of pleasure from every single website visit!
- vacri 11y ago"The most memory anyone needs is 640k"...
- 11y ago
- fao_ 11y agoIn reply to both this and the original discovery[1], I wonder if this is a valid (albeit morally dubious) method of backing up (or at least ensuring the survival of) information that is at risk from government/<insert 'bad person' here> censorship/removal/other. NB: Not that I condone this. [1]: https://twitter.com/a_de_pasquale/status/608997818913665024 https://twitter.com/a_de_pasquale/status/608997818913665024
- TD-Linux 11y agoDid you file bugs for either of these two browsers?
- inglor 11y agoGood idea https://code.google.com/p/chromium/issues/detail?id=500639&thanks=500639&ts=1434390736 https://code.google.com/p/chromium/issues/detail?id=500639&t... https://bugzilla.mozilla.org/show_bug.cgi?id=1174811 https://bugzilla.mozilla.org/show_bug.cgi?id=1174811
- groby_b 11y agoIs this a Mac only bug, or have you only repro-ed it on Mac?
- protomyth 11y agoSo a screwed up favicon can eat a wireless user's whole bandwidth for the month with them knowing it. Great...
- olalonde 11y agoNot to minimise this issue but there are other ways for websites to silently waste user bandwidth. I think the real issue here is that it crashes Chrome and can render the computer unresponsive.
- cma 11y agoSo can an ajax loop.
- inglor 11y agoAn ajax loop requires you to have JavaScript enabled and will show you a loader indicator.
- diggan 11y agoHow about just an huge image? The programmer implementing the ajax call doesn't necessary have to implement a loader indicator either...
- inglor 11y agoThe browser will give you a visual indicator (a loading sign) at the browser level for images or AJAX and JavaScript can be disabled. With the favicon issue these things don't happen.
- realityking 11y agoI'm pretty sure I've never seen a loading indicator for AJAX either in Safari or Chrome.
- iDemonix 11y ago
- firlefans 11y agoWay to ruin the fun for the rest of us ;)
- hartator 11y agoJust tested on Safari 8.0.6, doesn't seem to download the favicon at all. Weird, even after closing the tab, Chrome still keep downloading the favicon.
- ubanholzer 11y agoSafari Version 8.0.6 (10600.6.3) on OS X 10.10.3 is downloading it: https://imgur.com/B2LeRy4 https://imgur.com/B2LeRy4
- ubanholzer 11y agoit's also working on iOS 8.1.2. As soon as you tap on the share icon, the download starts: https://github.com/benjamingr/favicon-bug/pull/2 https://github.com/benjamingr/favicon-bug/pull/2
- vezzy-fnord 11y agoInteresting to see server-side JavaScript being used as an exploit language.
- inglor 11y agoThis is about as easy to do with every other language - I could have done it in C, or Python or PHP or Java or C# or whatever - node was just the lowest friction one for the PoC - all you ned is an HTTP server that lets you write dynamic requests - could have been bash even.
- ghuntley 11y agoln -s /dev/urandom /srv/wwwroot/favicon.ico
- fugyk 11y agoWhy do browser people always forget about favicons? Most browser saved favicon on private browsing and then this.
- frik 11y ago...and used favicons for the bookmarks.
- Nadya 11y agoMind telling me why that is an issue? My bookmark bar is entirely favicons. I remove the name and this allows me to fit more in quick-access without having to delve into folders.
- erichurkman 11y agoSame here. Sadly Safari does not use fav icons in the bookmark bar, so all of mine are emoji. Unfortunately, you run out of sensible emoji very quickly, so my brokerage ends up 🎲, Github ends up 🐱, and Hacker News ends up ⌛️.
- terminado 11y agoBecause Microsoft.
- rjcz 11y agoI've noticed it several months ago by going through my server logs - hadn't included 'favicon.ico' in the HTML and yet, the browser - Chrom(e|ium) - tried downloading it every time. Thanks for reminding me to report it ;^)
- psychometry 11y agoMost browsers have been doing that since favicons have existed. Older versions of IE used to check for /favicon.ico no matter what, even if you specify a different URL with a <link> tag. You really have no choice but to make the file available at the URL even today.
- iDemonix 11y agoThat's not a bug, it's a feature. Pretty much every modern browser will look in the default spot for a favicon if you don't specify it.
- underwater 11y agoYou should try and use ServiceWorkers to generate the file -- then you can have the client DOS itself.
- tiglionabbit 11y agoThis reminds me of a bug I found in an internal tool. We only had about 200 users, but somehow Apache would run out of workers because they were all busy serving some kind of request. Turns out our Apache configuration was wrong specifically in the case of serving the favicon. If you requested the favicon, it would get in a redirect loop, increasing the length of the url a little more each time until it hit the maximum url length and gave up. A new job like this would get kicked off every time any user visited a page, and it'd take several minutes before it finally gave up. So every user was unwittingly opening tons of long-running requests, with no indication that they were doing anything.
- shawkinaw 11y agoYeah, I hit something sort of similar but on the client side: While clicking around a single-page webapp, Chrome would manage to use up all its outbound connections (10 or so) trying to download non-existent favicons, leaving none for real use. And those favicon requests somehow never timed out. Chrome's favicon handling is pretty bad.
- drivingmenuts 11y agoI pray once or twice a month that someone somewhere will just end the favicon. Or at least make it's absence a non-logworthy event. Or replace it with something sane, like a .png.
- porges 11y agoAll major browsers support PNG favicons
- Dylan16807 11y agoNot only is there support in practice, but PNG files have been technically-valid .ico files for a decade. Edit: Actually on further investigation they might be omitting a header, but they're still 99% valid.
- frozenport 11y agoIs storing data as bits insane? For a 32x32 image, jpg overhead becomes significant.
- Dylan16807 11y agoWhy would you use JPG for something that should be pixel-art? But it's not really that bad. Well under 200 bytes of overhead for 1000 pixels. PNG has under 50 bytes of overhead.
- tomjepp 11y agoEven better - this works with compressed favicons. Take http://pastie.org/10242118 http://pastie.org/10242118 and create yourself a favicon file: dd if=/dev/zero of=favicon.png bs=1M count=4096 gzip -9 favicon.png you can now crash lots of browsers with minimal bandwidth usage :) demo: http://dev.tomjepp.uk/ http://dev.tomjepp.uk/
- tomjepp 11y agoThis makes a 4GB file when decompressed and is plenty large enough to crash a 32-bit browser. You may need a larger file to reliably crash 64-bit browsers.
- jfoster 11y agoHaven't tried it, but does it crash the browser or the tab? Under Chrome's architecture, a page should potentially be able to crash the tab, but not the browser. (or that's my understanding of it, anyway)
- empyrical 11y agoShould this have been done as a private disclosure to browser vendors first before going public, or is that more for security problems?
- nodesocket 11y agoSeems like an easy and logical fix for browsers. function fetchFavIcon() { if (favicon.fileSize > 1MB) { return false; } ... }
- voltagex_ 11y agoAnyone tested Firefox/Chrome/Webview for Android?
- jakeogh 11y agoI like Surf's approach: if(g_str_has_suffix(uri, "/favicon.ico")) webkit_network_request_set_uri(req, "about:blank"); http://git.suckless.org/surf/tree/surf.c#n237 http://git.suckless.org/surf/tree/surf.c#n237