-15

WARNING: Do not run the code samples below. They are potentially destructive, and can crash a computer/server.

Stack Snippets is not entirely secure. Some server-crashing scripts can still run:

var xhr = new XMLHttpRequest();
xhr.open("GET", "/");
for (i=1;i>0;i++) {
  xhr.send();
}

This sends infinite requests and can (instantly) crash a server. Another example is the client-side bomb:

for (i=1;i>0;i++) {
  var a = "This is dangerous!";
}

This, unfortunately, can also crash a browser.

So can Stack Snippets be confirmation-to-run when they have dangerous items (e.g. infinite loops, cookies, or infinite server requests)?

3
  • 2
    Re "can also crash a browser": What browser, incl. the version, did you try it on? Commented Jun 3, 2021 at 6:06
  • 6
    Any modern web browser will not allow a single loop 100% of its CPU time to prevent crashes, and warn the user/terminate the code if it's unresponsive for a longer period. This really should not be an issue, unless you're using a very old JS engine. If this were a real issue, visiting a malicious web page would cause a crash too, and that hasn't been the case the last decade.
    – Erik A
    Commented Jun 3, 2021 at 7:53
  • 3
    Before the server crashes your IP is black listed by the HA-Proxy.
    – rene
    Commented Jun 3, 2021 at 12:49

1 Answer 1

18

So can Stack Snippets be confirmation-to-run when they have dangerous items (e.g. infinite loops, cookies, or infinite server requests)?

This is provably impossible. It would require solving the halting problem, which is described by Wikipedia as:

In computability theory, the halting problem is the problem of determining, from a description of an arbitrary computer program and an input, whether the program will finish running, or continue to run forever. Alan Turing proved in 1936 that a general algorithm to solve the halting problem for all possible program-input pairs cannot exist.

Note that bit at the end stating that a general algorithm to solve the problem cannot exist. Unfortunately, determining whether a program runs forever (i.e., an infinite loop) or performs some other particular action is thus impossible. Imagine, for instance, a piece of code that checks if the user is a normal user or the detection system before running the infinite loop. Or perhaps it queries a remote server to ask whether to do it. If this were possible to detect, writing anti-malware software would be a lot easier.


Separately, it's worth noting that running the client-side one in the Stack Snippet editor doesn't crash my browser (Firefox), just freezes the page for a little while until I get asked by the browser if I want to stop it.

2
  • For updated versions of chrome, nothing crashes for me. In fact my chrome just reloads the page. So it's not too much of a problem.
    – 10 Rep
    Commented Jun 3, 2021 at 5:08
  • 7
    Not impossible if you assume all snippets are potentially dangerous.
    – khelwood
    Commented Jun 3, 2021 at 9:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .