search

uBlockOrigin / uBlock-issues

This is the community-maintained issue tracker for uBlock Origin
https://github.com/gorhill/uBlock
944 stars 81 forks source link

DoS with strict-blocking filter #1649

Closed vtriolet closed 3 years ago

vtriolet commented 3 years ago

Prerequisites

Description

A crafted URL that matches a strict-blocking filter can cause uBO to crash or consume a lot of memory when the URL is visited.

A specific URL where the issue occurs

A URL has been provided to gorhill via email. Details will be added later.

Steps to Reproduce

  1. Navigate to the crafted URL to trigger an extension crash or excessive memory consumption, depending on the browser

Expected behavior:

The strict-blocking warning page is displayed without any issues.

Actual behavior:

uBO crashes or consumes a lot of memory, depending on the browser

Your environment

gorhill commented 3 years ago

Version 1.36.2 is now live in Chrome Web store, Firefox's AMO, Opera Web store. Once 1.36.2 is published in the Microsoft Edge store, the details of how to trigger the issue will be disclosed (cc @nikrolls).

vtriolet commented 3 years ago

Hi @nikrolls, is there an ETA for the Edge release? Thank you.

gorhill commented 3 years ago

@vtriolet If ever you go ahead publishing before 1.36.2 become available in the Microsoft store, then maybe advise that users of Edge can always install uBO from the Chrome Web Store to get the safe version (link to instructions for users on how to do this).

nicole-ashley commented 3 years ago

Apologies, review seems to be very slow on the Edge Addons Store right now. 1.32.0 was the same. I expect approval any day now, though I already expected approval days ago.

Additionally, I haven't received notifications for the approval of the last couple of updates. So I will just check in regularly on this one so I can update here as soon as it's ready.

vtriolet commented 3 years ago

Apologies, review seems to be very slow on the Edge Addons Store right now. 1.32.0 was the same. I expect approval any day now, though I already expected approval days ago.

Additionally, I haven't received notifications for the approval of the last couple of updates. So I will just check in regularly on this one so I can update here as soon as it's ready.

Thank you for preparing the Edge release. I have decided to move forward with publication because I have to focus on other work and because this issue is not really secret anymore: there are multiple tickets and fixes in public view.

@vtriolet If ever you go ahead publishing before 1.36.2 become available in the Microsoft store, then maybe advise that users of Edge can always install uBO from the Chrome Web Store to get the safe version (link to instructions for users on how to do this).

Thanks for the tip. I have included a note in my write-up: https://github.com/vtriolet/writings/blob/main/posts/2021/ublock_origin_and_umatrix_denial_of_service.adoc

nicole-ashley commented 3 years ago

I've just received notification that the release has been approved for Edge. It's not showing up for me yet but this usually happens within several hours, likely due due global replication.

Update: it's now live.

gorhill commented 3 years ago

@vtriolet I issued an update of uMatrix with a fix, see https://github.com/gorhill/uMatrix/releases/tag/1.4.2. It has already been been approved on AMO, pending review in CWS.

vtriolet commented 3 years ago

@vtriolet I issued an update of uMatrix with a fix, see https://github.com/gorhill/uMatrix/releases/tag/1.4.2. It has already been been approved on AMO, pending review in CWS.

Thank you. I have updated my post with release details.