1522083 - Make target=_blank on a/area elements imply rel=noopener by default

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, enhancement, P2)

Description

[Anne (:annevk)]

We wanted to wait an additional cycle when we added this in 65. Nightly is now at 66, so it seems we can enable this by default as there's been nothing thus far in terms of fallout?

Comment 1

[Andrea Marchesini [:baku]]

Attachment: noreferrer.patch

Comment 2

[(no longer active)]

Comment on attachment 9038500 [details] [diff] [review]
noreferrer.patch

Review of attachment 9038500 [details] [diff] [review]:
-----------------------------------------------------------------

It's too late to land this for 66 a we're in the soft freeze, but you can try to land it in the 67 cycle.  It is a good time to send an intent to ship and wait for the next uplift while people make their comments on dev-platform.  :-)

Comment 3

[(no longer active)]

BTW I really would have preferred if we had shipped this and bug 1509346 together. I r+ed this in the interest of not having the perfect be the enemy of the good...

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/ebf9f694b72d
Enable noopener by default for area and anchor elements with target=_blank and no rel attribute set, r=ehsan

Comment 5

[Stefan Hindli [:stefan_hindli]]

https://hg.mozilla.org/mozilla-central/rev/ebf9f694b72d

Comment 6

[Neha Kochar [:neha]]

Discussed with Ehsan and considering bug 1531289's fix touches a lot of page loading and can potentially cause a lot of regressions, it is a safer bet to let this ride on with 68 nightly (along with the fix for bug 1531289) but disable the pref in beta.

Baku, can you please backout the enabling of noopener by default for 67 beta?

Comment 7

[Andrea Marchesini [:baku]]

See bug 1546415.

Comment 8

[Neha Kochar [:neha]]

[Tracking Requested - why for this release]:
This was backed out in bug 1546415. We should enable this pref in 68 and also fix bug 1531289 in 68.

Comment 9

[Julien Cristau [:jcristau]]

comment 6 sounds rather scary about landing bug 1531289 late... either way I'm not sure I need to track this for 68.

Comment 10

[Eric Shepherd [:sheppy]]

What are the odds of this landing for Firefox 68? It seems pretty unlikely at this point, but I need to try to be sure, since it's currently scheduled to be documented for 68.

Comment 11

[Erica Wright [:ewright]]

(In reply to Eric Shepherd [:sheppy] from comment #10)

What are the odds of this landing for Firefox 68? It seems pretty unlikely at this point, but I need to try to be sure, since it's currently scheduled to be documented for 68.

Sorry, this is my fault it's dropped off. There is still a test failure with the current patch.

Comment 12

[Andrea Marchesini [:baku]]

I confirm that this is not going to be enabled for 68. We don't need to have it documented for 68.

Comment 13

[Andrea Marchesini [:baku]]

Attachment: Bug 1522083 - Enable noopener by default for area and anchor elements with target=_blank and no rel attribute set, r?ehsan

Comment 14

[:Gijs (he/him)]

:baku, what blocks relanding this?

Comment 15

[Andrea Marchesini [:baku]]

Finally nothing. Let's land it!

Comment 16

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/166d1d815d33
Enable noopener by default for area and anchor elements with target=_blank and no rel attribute set, r=ckerschb

Comment 17

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/166d1d815d33

Comment 18

[Kohei Yoshino]

Posted a site compatibility note for the change.

Comment 19

[Chris Mills [:cmills]]

I've documented this on MDN; see https://github.com/mdn/sprints/issues/3416#issuecomment-653106688 for the full details.