1133608 - Browser honors window.open requests in interval timer handlers even long after an interactive event

Status: NEW

(Core :: DOM: Core & HTML, defect, P5)

Description

[Mike McNally]

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:35.0) Gecko/20100101 Firefox/35.0
Build ID: 20150125221831

Steps to reproduce:

http://jsfiddle.net/wcxvrt8t/

Basically the code involves a "click" handler for a button. The handlers starts an interval timer which, after 5 periods of 1 second each, attempts to open a new window/tab.


Actual results:

Running Firefox 35.0.1 on Ubuntu 14.10 (64-bit), my browser dutifully opens a new tab after 5 seconds.


Expected results:

For all I know, this behavior may be deliberate. I could not find a duplicate bug to explain the situation. That said, I think it's a little fishy, since an underhanded site could freely associate delayed pop-up windows/tabs with any innocuous mouse clicks, resulting in new windows/tabs popping up without any apparent relationship to user activity.

Comment 1

[Daniel Veditz [:dveditz]]

Unhiding because this is more of an annoyance than a security vulnerability.

Comment 2

[Firefox Bug Husbandry Bot]

https://bugzilla.mozilla.org/show_bug.cgi?id=1472046

Move all DOM bugs that haven’t been updated in more than 3 years and has no one currently assigned to P5.

If you have questions, please contact :mdaly.