I3:FeatureTest-Browser Add-On DOS Avoidance

From OSIS Open Source Identity Systems

list help  copy  as XML  edit

Feature Test	Browser Add-On DOS Avoidance
Test Type	Selector Invocation
Identifier	FTI3-iba-rptrigger-5
Description	Tests that it is possible to escape a DOS loop where control is constantly sent to the selector
Role tested	Information Card Browser Add-On
Known Successful Reference Solution(s)	https://pamelaproject.com/osis/catalyst-eu-07/form-submission/test3a.php
Success Criteria	Selector is triggered (note that the transaction does not need to complete)
Failure Criteria	Selector is not triggered

Features Proven

Feature	feature_type	solution_role
Enable Selector Disablement During Denial of Service	Information Card Browser Add-On	interop

Caveats

1. Note #1: this test is based on JavaSrcript submission - if you fail the Javascript Test, this test will not run for you.
2. Note #2: this test will loop 20 times - long enough to try things to get out, but not indefinite. If you cannot escape the loop, just keep cancelling/exiting the selector, and control will eventually be restored.
3. Note #3: The test is merely a form containing an information card object that posts to itself 20 times in a row. If you want to see exact source code, as meager as it is, contact Pam.

Instructions

1. Open the result page for the solution for this particular feature test.
2. In a different browser tab or window, open the link to the test (listed above).
   1. Selector should immediately open -- if it does, choose to exit, or cancel (if you submit a card, it won't be read)
3. Every time you exit the selector, you will be redirected back to a page which yet again auto-submits the selector.
4. In the case of selectors which take control away from the user, there should be some way to disable the selector from starting the next time around, so that the evil looping code can be dealt with.
   1. Set outcome:
   2. If there was a way to pause and/or disable invocation of the Selector in order to terminate the loop, set the outcome to Works.
   3. If you cannot get out of the loop, set the outcome to Fails.
   4. If you saw specific issues, mark the outcome as "Issues" and outline the issues by commenting on the "Talk" tab of this page.
5. Add either four tilde ~~~~ signs or a text name into the "testedby" parameter.
6. Update the date tested, operating systems, and tested solutions parameters of the results page.