57908 - Please oh please let me disable automatic windowOpen

Status: VERIFIED DUPLICATE of bug 29346

(Core :: Security: CAPS, defect, P3)

Description

[Frank Belew]

I am so sick and tired of web pages abusing the windowOpen javascript command 
when loading or closing a window. especially closing. For the love of all that
is good in the world, please let users disable all windowOpen except when
specifically clicked. 

I left it as normal, because a windowOpen cluster can easily bring a machine to
its knees, or crash the browser.

Comment 1

[R.K.Aa.]

I think this is a dup of bug 858.
40005 was marked dup of that one.
Bug 40005 is "Option to disable windows being spawned on exit"

From comment by Norris Boyd in bug 858:

"------- Additional Comments From Norris Boyd 2000-01-07 15:25 -------

I've got changes in my tree that allow a user to disable JavaScript for certain
selected sites using lines in the all.js preferences file like:

pref("security.policy.strict.sites", "http://warp.mcom.com");
pref("security.policy.strict.javascript.enabled", "noAccess");

------

Domains should be a space-separated list.
See details in the bug.
Related: bug 7380.

Comment 2

[Phil Schwartau]

Browser, not engine. Reassigning to Security: CAPS for further consideration.

Comment 3

[Mitchell Stoltz (not reading bugmail)]

This can be done currently; see 
http://www.mozilla.org/projects/security/components.configPolicy.html
There's one error in this dociument, all preference lines should start with 
"capability.policy." NOT "capability.principal." 

Basically, add these two lines to your prefs.js file:
user_pref("capability.policy.mygroup.sites"," <space-separated list of urls for 
sites which should not be able to window.open>");
user_pref("capability.policy.mygroup.windowinternal.open","noAccess");

or, to disable ALL window.opens, add this single line:
user_pref("capability.policy.default.windowinternal.open","noAccess");

Yes, we need a UI for this. There's already a bug on that somewhere, so please 
don't file another one. 

Comment 4

[John Unruh]

Mass changing QA to ckritzer.

Comment 5

[ckritzer (gone)]

Re-opening.

The fix described above seems to be circumvented by the fact that the current
browser seems to overwrite the prefs when it starts or exits.

I have noticed one thing:  When I had the prefs.js file already open, the pref
settings described *did* work.  The problem is that you would have to have the
file open and make these edits every time.

Mitch, comments?

Comment 6

[ckritzer (gone)]

Attachment: Testcase file

Comment 7

[Mitchell Stoltz (not reading bugmail)]

Mozilla reads fropm prefs.js on startup and writes it out again on exit. Any
changes made to prefs.js while Mozilla is running will have no effect and will
be overwritten. hand-editing prefs.js was never meant to be a permanent method
for configuring security; we need a UI! I'm working on making caps more
XPConnect-friendly to make creating a UI possible. Anyway, this is a dup.

*** This bug has been marked as a duplicate of 29346 ***

Comment 8

[ckritzer (gone)]

Fair enough (and I agree).

Marking VERIFIED DUPLICATE.