Hard to exit/close Brave when site spams you with message box / alerts

[lilith]

Test Plan

1. Visit http://jsbin.com/fiyojusahu/edit?html,output
2. In the output area, click the Click me to test an alert button
3. Click OK to close alert
4. Click the Click me to test an alert button again
5. Switch should be visible now that says "Prevent this page from creating additional dialogs"
6. Switch to true and click OK
7. Click the Click me to test an alert button again
8. Verify nothing happens (nothing is shown, no console errors)
9. Open http://jsbin.com/sadunogefu/edit?html,output in a new tab
10. Repeat steps 2-8 (this jsbin is for confirm)

original issue text

Did you search for similar issues before submitting this one?

Yes

Describe the issue you encountered:

Mistyping "gmail.com" brings one to "need-support.in". There appears to be an message box loop; it is not possible to dismiss the message box, as the content causes the dialog layout height to exceed the screen height. Brave process do not respond to kill.

Brave takes no action when File->Close or File->Quit is clicked. Other tabs cannot be switched to.

Expected behavior:

• Brave should detect a message box loop (or two messages with the same content), as other browsers.
• It should also truncate the number of lines shown in a message box to prevent any buttons from being hidden.
• It should not permit a message box from preventing a close/quit action.

Details

• Platform: Ubuntu 14.04
• Brave Version: 0.11.3
• Steps to reproduce: Visit need-support.in
• Any related issues: Only xkill was able to terminate the process for recovery.

[da2x]

There is a reason why other browsers have a checkbox in JS dialogs saying “Don’t allow more dialogs from this origin” that stops JS execution in the tab. :)

[bridiver]

@bbondy I think we should add this one to 1.0. If you get hit with this it can be difficult or even impossible (for the average user) to get out of even after killing Brave. This fix is relatively straightforward and can be done without any electron changes

[diracdeltas]

a HackerOne reporter pointed out that the same thing can happen with window.print: https://hackerone.com/reports/176364

[BrendanEich]

Wow, window.print from Netscape 4 daze.

I think @jonathansampson may be game to take this issue.

[cndouglas]

Related issue: #2755

[bsclifton]

Created #7106 to separately track the window.print issue

[bsclifton]

Moving to 0.13.4

[bsclifton]

+1 from community:
https://community.brave.com/t/completely-stuck-on-a-malicious-website/1331

[srirambv]

Verified on master. Works fine