Security implications of multi-threaded javascript

Question

Reading through this question on multi-threaded javascript, I was wondering if there would be any security implications in allowing javascript to spawn mutliple threads. For example, would there be a risk of a malicious script repeatedly spawning thread after thread in an attempt to overwhelm the operating system or interpreter and trigger entrance into "undefined behavior land", or is it pretty much a non-issue? Any other ways in which an attack might exploit a hypothetical implementation of javascript that supports threads that a non-threading implementation would be immune to?

Update: Note that locking up a browser isn't the same as creating an undefined behavior exploit.

Answer 1

Well I think that the only major example of multi-threaded javascript is Google's chrome (WOULD THEY RELEASE IT ALREADY JEEZ) and if I understand it the javascript will only one process per tab, so unless it started spawning tabs (popups) I would assume this would be a null issue, but I think that Google has that under wraps anyway, the are running all the javascript in a sandbox.

Answer 2

Again, we need to make a distinction between 1) multithreaded support in the language (which I don't think is seriously being discussed as something that will happen) and 2) usage of multiple threads in the JavaScript engine/interpreter in the browser.

For #2, I can't see how this can really add any possible security concerns to the engine/interpreter, unless there are flaws in the implementation.

Answer 3

Well, you can already lock up a browser and seriously slow down a system with badly-behaved JS. Enlightened browsers have implemented checks for this sort of thing, and will stop it before it gets out of hand.

I would tend to assume that threads would be dealt with in a similar manner.

---

Perhaps you could explain what you mean by "undefined behavior" then? An interpreter that allowed untrusted script to directly control the number of OS-native threads being run would be incredibly naive - i don't know how Gears runs things, but since the API is centered around Workers in WorkerPools, i would be very surprised if they aren't limiting the total number of native threads in use to some very low number.

Answer 4

No, multiple threads would not add extra security problems in a perfect implementation. Threaded javascript would add complexity to the javascript interpreter which makes it more likely to have an exploitable bug. But threads alone are not going to add any security issues.

Threads are not present in javascript because "Threads Suck" - read more from the language designer (http://weblogs.mozillazine.org/roadmap/archives/2007/02/threads_suck.html)