Original URL: http://www.theregister.co.uk/2013/02/28/html_5_implementation_bug_drive_filler/

Browser makers open local storage hole in HTML5

Bad implementation of disk space limits

By Richard Chirgwin

Posted in Security, 28th February 2013 21:59 GMT

A slip-up in the implementation of HTML5 on Chrome, Opera and Internet Explorer can be exploited to fill users’ hard drives, according to a 22-year-old Web developer from Stanford.

Feross Aboukhadijeh has posted a proof-of-concept of the exploit here and a demonstration page here.

He explains that HTML5 is designed to allow bigger cookies than its predecessor standards. Up to 10 MB of local storage is permitted by the standard, but the standard also recommends that browsers place limits on how much storage is used. Browsers also need to watch out for sites trying to use subdomains or “affiliated domains” to get around the storage limits.

While the browsers Aboukhadijeh identifies implement the per-domain limits – 2.5 MB in Chrome, 5 MB in Firefox and Opera, 10 MB in IE – they don’t properly block the use of storage by affiliated domains.

Filldisk example site

The FillDisk demonstration site

“Thus, cleverly coded websites, like FillDisk.com, have effectively unlimited storage space on visitor’s computers”, he writes. Only recent versions of Firefox are unaffected, he says, because it has a better implementation of local storage (it does, however, work on older versions of Firefox, according to this author’s test).

Aboukhadijeh claims the proof-of-concept code will fill 1 GB every 16 seconds on a Macbook Pro Retina’s solid state drive.

While it’s not the scariest bug in the world, he says users of affected browsers should join together in filing bug reports so their browser vendors fix the bug. ®

Update: A commenter says Opera is unaffected. To test, I installed Opera 12.14 on OSX. The disk-filler gets as far as claiming 76 MB of space, after which Opera asked if I wanted to raise the storage limit - so I agree that it appears to work properly. I have not tested Opera on any other OS or version. ®