How to clearInterval with unknown ID?

Question

Say someone (evil) has set us a timer with setInterval, but we don't know its ID (we don't have the reference to the object, that setInterval is returning, nor its value)

(function(){
  setInterval(function(){console.log('pwned')},
              10000)
})();

Is there a way, how to clear it? Is it possible to acces the timer some other way? Or at least in particular browser/javascript engine?

David Flanagan touches similar topic his big JSTDG. setInterval() method, use in malicious code key in the index points to

... Some browsers detect repeated dialog boxes and long-running scripts and give the user the option to stop them. But malicious code can use methods such as setInterval() to load the CPU and can also attack your system by allocating lots of memory. There is no general way that web browsers can prevent this kind of ham-handed attack. In practice, this is not a common problem on the Web since no one returns to a site that engages in this kind of scripting abuse!

Solution 1

From quick test, all major browsers (latest Chrome, Firefox and IE) give pretty small numbers as the ID so just looping "blindly" over all possible numbers should work just fine:

function ClearAllIntervals() {
    for (var i = 1; i < 99999; i++)
        window.clearInterval(i);
}

Full example:

window.onload = function() {
    window.setInterval(function() {
        document.getElementById("Tick").innerHTML += "tick<br />";
    }, 1000);
    window.setInterval(function() {
        document.getElementById("Tack").innerHTML += "tack<br />";
    }, 1000);
};

function ClearAllIntervals() {
    for (var i = 1; i < 99999; i++)
        window.clearInterval(i);
}

#Placeholder div { width: 80px; float: left; }

<button type="button" onclick="ClearAllIntervals();">Clear All</button>
<div id="Placeholder">
    <div id="Tick"></div>
    <div id="Tack"></div>
</div>

This will stop all intervals, can't stop specific interval without knowing its ID of course.

As you can test for yourself, it should work on all major browsers mentioned above.

Solution 2

Well, empirically trials in Chrome show that setInterval returns a number which increments for each call. So if you are SURE that you setInterval was the last one set the following would work :

function clearLastInterval () {
  var i = setInterval (function () {}, 10000);
  clearInterval (i-1);
  clearInterval (i);
}

I'm not sure I would recommend this though ;-)

Solution 3

I tried the approach suggested by #Shadow Wizard and it worked in clearing the interval. However, this approach had side effects afterwards. In my particular case, I was unable use jquery.fadeTo() after clearing all of the intervals.

The approach that I settled on is a cleaner solution, which is to redefine the setInterval method and save the interval ids in the re-defined methods. As shown here, I put the the ids into an array and then clear all of them. With a little more refinement of the structure to store the arrays, you could label them and clear them selectively.

var intervalTracking = new Array();
var intervalCount=0;

window.oldSetInterval = window.setInterval;
window.setInterval = ( function(func, interval) {
    var interval = oldSetInterval(func, interval);
    intervalTracking[++intervalCount]=interval;
    return interval;
});

function clearAllIntervals() {
    for (var i = 0 ; i <= intervalCount ; i++) {
    window.clearInterval( intervalTracking[i] );
    }
}

This seems to work!

Comments

[Shadow The Kid Wizard]

Related - stackoverflow.com/questions/3141064/…

[Shadow The Kid Wizard]

Hmm.. another idea - does by any chance they give the function a name?

[mykhal]

Shadow Wizard, in this case, it was unfortunately set in the closure (which is sometimes considered as a nice feature to use for security purposes) .. i know, this question is somewhat theoretical, because we probably can in most cases find and edit the nasty code locally in some browsers

[mykhal]

Shadow Wizard .. er, maybe it's not exactly the closure. but it's an anonymous function, which was executed. having a reference to the function would help us somehow?

[Shadow The Kid Wizard]

yes, you can (in theory at least) override the function and put your own function with your own code. The function that is declared last with the same name will be the one getting executed at run time.

[mykhal]

it's a possible way :) somethig like pauseInterval would be helpful for manual finding of the proper timer, since we don't want to kill the innocent ones..

[mykhal]

also see my comment below Hans B PUFAL's answer :)

[Shadow The Kid Wizard]

Well, my way will work even if there are lots of intervals activated at different points in the code - however clearly Hans way is more elegant and efficient.

[kristiyan.mitev]

A little late to the party - It should be noted that setInterval and setTimeout use the same pool of IDs, so this will also cancel any setTimeouts.