Imagine a scenario where someone with malicious intent has set a timer using setInterval
, but without providing us with the ID of the timer. This means we do not have a reference to the object that setInterval is returning, nor its actual value.
(function(){
setInterval(function(){console.log('hacked')},
10000)
})();
Is there any way to clear this timer? Can we access it through another method or in a specific browser/javascript engine?
David Flanagan delves into a similar topic in his extensive JSTDG.
The setInterval() method used in malicious code
section points out the repercussions.
... Some browsers detect repeated dialog boxes and long-running scripts and give the user the option to stop them. But malicious code can use methods such as setInterval() to load the CPU and can also attack your system by allocating lots of memory. There is no general way that web browsers can prevent this kind of ham-handed attack. In practice, this is not a common problem on the Web since no one returns to a site that engages in this kind of scripting abuse!