> do we have tests that ensure popups ...
And I guess we need to make sure window.open() and target=_blank are treated the same wrt inheriting the sandbox properties.
Bug 1744352 Comment 5 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
> do we have tests that ensure popups ...
And I guess we need to make sure window.open() and target=_blank are treated the same wrt inheriting the sandbox properties.
These cases should all be covered by WPT, except the case in this bug because we're the only browser engine left that opens javascript links in a new window so no point in writing cross-browser tests for it. (Maybe Internet Explorer still does, too?). Even Brendan's own browser doesn't try to bring that behavior back -- time to throw in the towel? Would certainly stop a bunch of unique-to-Firefox exploit attempts.