Closed Bug 1353466 Opened 7 years ago Closed 4 years ago

Window opened with window.open, `noopener` feature cannot close itself

Categories

(Core :: DOM: Navigation, defect, P2)

defect

Tracking

()

RESOLVED FIXED
mozilla79
Tracking Status
firefox79 --- fixed

People

(Reporter: lyza, Assigned: smaug)

References

(Depends on 2 open bugs, Blocks 1 open bug)

Details

Attachments

(1 file)

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Steps to reproduce:

* `window.open('foo.html', '', 'noopener')`
* Within `foo.html`: `window.close()`


Actual results:

Logged warning "Scripts may not close windows that were not opened by script." 
Window is not closed.


Expected results:

According to current spec language[1], `foo.html`'s browsing context meets the requirements for being script-closable—`window.close` should work here.

There is some debate in an existing bug thread[2] that the current spec language here may not be web-compatible, but in any case, current behavior leads to some orphaned windows in some Web Platform Tests[3].

[1]: https://html.spec.whatwg.org/#apis-for-creating-and-navigating-browsing-contexts-by-name
[2]: https://bugzilla.mozilla.org/show_bug.cgi?id=1316857
[3]: https://github.com/w3c/web-platform-tests/pull/5306
Component: Untriaged → DOM: Security
Product: Firefox → Core
Clearly a bug in that we're using a signal (the presence or absence of window.opener) that has nothing to do, really with what we're interpreting it to mean. We might have an opener in a window NOT opened by script (bug 1316857) or we might have a script-opened window without an opener (this bug). Probably should be fixed together by recording "script-opened-window" in some other way.
Component: DOM: Security → DOM: Core & HTML
Depends on: 1316857
Status: UNCONFIRMED → NEW
Ever confirmed: true
Priority: -- → P2
Moving to p3 because no activity for at least 1 year(s).
See https://github.com/mozilla/bug-handling/blob/master/policy/triage-bugzilla.md#how-do-you-triage for more information
Priority: P2 → P3
Blocks: 1608852
Blocks: 1531289
Blocks: 1591302

I think this bug is the cause of a lot of the target=_blank fallout. We should reconsider its priority.

Component: DOM: Core & HTML → DOM: Navigation
Flags: needinfo?(ehsan)
Priority: P3 → --
Flags: needinfo?(ehsan) → needinfo?(htsai)

I'll take an action to explore resource alternatives.

Flags: needinfo?(htsai)
Assignee: nobody → bugs
Priority: -- → P2
Attachment #9150207 - Attachment description: Bug 1353466, 'A browsing context is script-closable ... if it is a top-level browsing context whose session history contains only one Document' → Bug 1353466, 'A browsing context is script-closable ... if it is a top-level browsing context whose session history contains only one Document', r=peterv
Depends on: 1321388
Pushed by opettay@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/1e166841f170
'A browsing context is script-closable ... if it is a top-level browsing context whose session history contains only one Document', r=peterv
Backout by dluca@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/e8d0f18c2300
Backed out changeset 1e166841f170 for Mochitest failures in gecko/dom/base/nsGlobalWindowOuter.cpp. CLOSED TREE

aha, IsFrame() is broken in Fission.

Pushed by opettay@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/a312f7cd30fc
'A browsing context is script-closable ... if it is a top-level browsing context whose session history contains only one Document', r=peterv
Status: NEW → RESOLVED
Closed: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla79
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: