1131187 - Disable onbeforeunload dialog for frames

Status: REOPENED

(Core :: DOM: Core & HTML, enhancement, P3)

Description

[Jesse Ruderman]

(Split from bug 1125285)

Comment 1

[François Marier [:francois]]

Attachment: 1131187.html

Test page for this bug.

Comment 2

[François Marier [:francois]]

Attachment: 1131187-frame.html

Comment 3

[François Marier [:francois]]

I couldn't find a way to reproduce this bug on Nightly 60.

It looks like we may not allow any of (alert,confirm,prompt) from a beforeunload event either in a frame or on a top-level page.

Comment 4

[Tanvi Vyas[:tanvi]]

Jesse, can you provide more info on what this bug is about or provide a testcase?

Comment 5

[François Marier [:francois]]

Attachment: 1131187.html

Working test case using the "blur" event like in bug 1125285.

Comment 6

[François Marier [:francois]]

Attachment: 1131187-frame.html

Comment 7

[François Marier [:francois]]

While there is an infinite series of dialogs, the "Prevent this page from creating additional dialogs" checkbox and allows users to end the dialogs and close the tab.

Comment 8

[:Gijs (out for now; he/him)]

I don't think this is WFM, the testcases don't test what this bug is about.

The problem here is basically:

1. parent page
2. loads iframe page, which registers a beforeunload handler which returns a string / calls preventdefault on the event
3. parent page navigates child page, which triggers the beforeunload handler, which creates a beforeunload prompt.

The contention of this bug is that we shouldn't show beforeunload dialogs for frames at all.

Comment 9

[François Marier [:francois]]

Attachment: 1131187.html

Thanks for this Gijs. I was finally able to create a test case for this bug.

Comment 10

[François Marier [:francois]]

Attachment: 1131187-frame.html

Comment 11

[:Gijs (out for now; he/him)]

As noted in bug 1125285, this now only fires if you interact with the page (e.g. by clicking the button). It's no longer possible for the document to spam you via a subframe without clicks/keypresses , because of bug 636905 (though see bug 1345830).

We have bug 578828 to disable beforeunload dialogs entirely. I'm not convinced either that or this bug would be web-compatible.

One other thing we could do is making beforeunload prompts subject to the 'prevent this page from opening more dialogs' permission (and include a checkbox for it by default in beforeunload dialogs). However, that won't work cross-site when the tab navigates frames, so will probably only offer limited help to people affected by this. That said, the interaction flag will get reset when the page navigates, so then hopefully that will help prevent dialogs on new domains.