400441 - JavaScript can force wanted pop up window to close if you click location bar

Status: RESOLVED WONTFIX

(Firefox :: Address Bar, defect)

Description

[Peter]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a8) Gecko/2007091216 GranParadiso/3.0a8
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a8) Gecko/2007091216 GranParadiso/3.0a8

Pop up window in Firefox 3.0(Gran Paradiso) will have location bar. So that user can easily copy and alter current URL. But JavaScript can meddle in user interface when coping or changing URl. If pop up has following code it will be closed when clicked in location bar:
onBlur="self.close()" onClick="self.close()"

Reproducible: Always

Steps to Reproduce:
1. Open test page.
2. Click an image in the gallery
3. Pop up will open with an image.
4. Click anywhere in location bar.
Actual Results:  
Wanted pop up window will close.

Expected Results:  
Wanted pop up window will not close. Instead I should be able to play around with URL.

Comment 1

[Jesse Ruderman]

The forced location bar is there to guarantee that you know where you are; it's
an anti-spoofing measure.  It's not there to *guarantee* that you can copy the
URL or navigate to a different page.

I don't think it would make sense for Firefox to stop sending web pages onblur
events or limit when scripts can can call window.close() on popups.

Comment 2

[Shawn Wilsher :sdwilsh]

Bulk closing all UNCONFIRMED bugs dealing with places that haven't had any bug activity in over 120 days, have no votes, and are not enhancement requests.

If you are still experiencing this issue in Firefox 3.0 or later, please re-open the bug with steps to reproduce (if they were not part of the original comment).

Comment 3

[Jesse Ruderman]

The reporter believes this is an annoyance or security hole, so this should get a real WONTFIX if we're not going to fix it.

Comment 4

[Peter]

Yes, I regard this as an annoyance.

to: Shawn Wilsher :sdwilsh
I'm still experiencing the issue in 3.7a6pre. The test URL seems to be working even now.

to: Jesse Ruderman
The location bar should guarantee that I can click it and have no undesirable consequences. Because it's my location bar. You would not expect your firefox to quit if you click a menu item or even the awesomebar, wouldn't you?

Comment 5

[Ada [:adalucinet]]

Reproduced with Nightly 25.0a1 (Build ID: 20130724222711). I've encountered the same issue on Chrome and Opera; Safari doesn't even open the popup;
So this is a site issue.