Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How to clearInterval with unknown ID?

Say someone (evil) has set us a timer with setInterval, but we don't know its ID (we don't have the reference to the object, that setInterval is returning, nor its value)

(function(){   setInterval(function(){console.log('pwned')},               10000) })(); 

Is there a way, how to clear it? Is it possible to acces the timer some other way? Or at least in particular browser/javascript engine?

David Flanagan touches similar topic his big JSTDG. setInterval() method, use in malicious code key in the index points to

... Some browsers detect repeated dialog boxes and long-running scripts and give the user the option to stop them. But malicious code can use methods such as setInterval() to load the CPU and can also attack your system by allocating lots of memory. There is no general way that web browsers can prevent this kind of ham-handed attack. In practice, this is not a common problem on the Web since no one returns to a site that engages in this kind of scripting abuse!

like image 461
mykhal Avatar asked Jul 27 '11 10:07

mykhal


People also ask

How can I clearInterval without ID?

How to Clear setInterval() without Knowing the ID. Declaring a setInterval() without keeping a reference to it (which is returned from the function call setInterval(), it returns an id number for the registered event). Like so: var interval = setInterval(function() { console.

Does clearInterval stop immediately?

I did make a fiddle to test it, and it turns out clearInterval stops all future execution, even those that have already be queued.

What is clearInterval ID );?

Definition and Usage The clearInterval() method clears a timer set with the setInterval() method.


1 Answers

From quick test, all major browsers (latest Chrome, Firefox and IE) give pretty small numbers as the ID so just looping "blindly" over all possible numbers should work just fine:

function ClearAllIntervals() {     for (var i = 1; i < 99999; i++)         window.clearInterval(i); } 

Full example:

window.onload = function() {      window.setInterval(function() {          document.getElementById("Tick").innerHTML += "tick<br />";      }, 1000);      window.setInterval(function() {          document.getElementById("Tack").innerHTML += "tack<br />";      }, 1000);  };    function ClearAllIntervals() {      for (var i = 1; i < 99999; i++)          window.clearInterval(i);  }
#Placeholder div { width: 80px; float: left; }
<button type="button" onclick="ClearAllIntervals();">Clear All</button>  <div id="Placeholder">      <div id="Tick"></div>      <div id="Tack"></div>  </div>

This will stop all intervals, can't stop specific interval without knowing its ID of course.

As you can test for yourself, it should work on all major browsers mentioned above.

like image 169
Shadow Wizard Hates Omicron Avatar answered Sep 23 '22 05:09

Shadow Wizard Hates Omicron