1419960 - Make the noopener window feature not affect whether other window features are enabled

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, enhancement, P2)

Description

[Boris Zbarsky [:bzbarsky]]

The spec is not making progress in https://github.com/whatwg/html/issues/1902 and it's causing sites real problems (e.g. see bug 1416728 comment 25).  We should just unilaterally change our behavior here.

Comment 1

[Nika Layzell [:nika] (ni? for response)]

I agree - the current behaviour is unusable. We should make `window.open(url, "_blank", "noopener")` act exactly like `window.open(url, "_blank")` except that opener is not set.

Comment 2

[Anny Gakhokidze [:annyG]]

Attachment: Bug 1419960 - Make the noopener window feature not affect whether other window features are enabled, r=nika

MozReview-Commit-ID: 538GrCw85g

Comment 3

[Phabricator Automation]

Comment on attachment 8992238 [details]
Bug 1419960 - Make the noopener window feature not affect whether other window features are enabled, r=nika

:Nika Layzell has approved the revision.

https://phabricator.services.mozilla.com/D2150

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/7122e56941ef
Make the noopener window feature not affect whether other window features are enabled, r=nika

Comment 5

[Boris Zbarsky [:bzbarsky]]

Please send an intent to ship for this?

We should probably do something similar for noreferrer too, right?

Comment 6

[Nika Layzell [:nika] (ni? for response)]

(In reply to Boris Zbarsky [:bz] (no decent commit message means r-) from comment #5)
> Please send an intent to ship for this?

Anny, would you write up an intent to ship (https://wiki.mozilla.org/ExposureGuidelines#Intent_to_ship) - I can help you look over it before we send it to dev-platform.

> We should probably do something similar for noreferrer too, right?

IIRC we don't allow "noreferrer" as a window.open flag, but rather only allow it as a rel="" attribute. When it's used in that way it's already stripped out of the features string by nsDocShell::InternalLoad.

Comment 7

[Boris Zbarsky [:bzbarsky]]

> IIRC we don't allow "noreferrer" as a window.open flag

Ah, ok.  I saw it in the test the patch for this bug modifies, but maybe there it's basically acting just like "nosuchflag" would...

Comment 8

[Cristina Coroiu [:ccoroiu]]

https://hg.mozilla.org/mozilla-central/rev/7122e56941ef

Comment 9

[Anny Gakhokidze [:annyG]]

I sent out an Intent to ship email to dev-platform (also see here https://groups.google.com/forum/#!topic/mozilla.dev.platform/6cTk_b1l6LE)

Comment 10

[Chris Mills [:cmills]]

Probably worth making a note about this somewhere.

Comment 11

[Kohei Yoshino]

Posted the site compatibility note: https://www.fxsitecompat.com/en-CA/docs/2018/noopener-option-for-window-open-no-longer-affects-other-window-features/

Comment 12

[Eric Shepherd [:sheppy]]

Filed PR to update compat table for rel="noopener":

https://github.com/mdn/browser-compat-data/pull/2748

And updated:

https://developer.mozilla.org/en-US/docs/Web/API/Window/opener
https://developer.mozilla.org/en-US/docs/Web/API/Window/open (noopener under window features)

And updated Firefox 63 for developers.