174370 - javascript flash code that opens unrequested window when it's disabled

Status: RESOLVED DUPLICATE of bug 150340

(SeaMonkey :: General, defect)

Description

[joseph brown]

the following html will open an unrequested window when it's been disabled in
preferences:

<script language=JavaScript>
var target="_blank";
var URL = new Array();
URL[1] =
"http://rd.yahoo.com/M=233041.2401128.3855100.458184/D=news/S=7665819:N/A=1260081/R=0/id=flashurl/*http://www.oneshare.com/index.asp?campaign_id=5631
";
var link="javascript:openWindow(1)";
var flashfile =
'http://us.a1.yimg.com/us.yimg.com/a/1-/flash/one_share/superbanner.swf?clickTAG='+link+'';
var altURL =
"http://rd.yahoo.com/M=233041.2401128.3855100.458184/D=news/S=7665819:N/A=1260081/R=1/id=altimgurl/*http://www.oneshare.com/index.asp?campaign_id=5631
";
var altimg =
"http://us.a1.yimg.com/us.yimg.com/a/1-/flash/one_share/728x90oneshare.gif";
var width = 728;
var height = 90;
</script>
<script language=JavaScript
src=http://us.a1.yimg.com/us.yimg.com/a/1-/jscodes/072002/ct_072002.js>
</script>
<noscript>
<a
href="http://rd.yahoo.com/M=233041.2401128.3855100.458184/D=news/S=7665819:N/A=1260081/R=2/id=noscript/*http://www.oneshare.com/index.asp?campaign_id=5631
" target=_blank><img
src="http://us.a1.yimg.com/us.yimg.com/a/1-/flash/one_share/728x90oneshare.gif"
width=728 height=90 border=0></a>
</noscript>

Comment 1

[Boris Zbarsky [:bzbarsky]]

If the window is actually opened by the flash plugin (the code you have cited is
somewhat incomplete) then Mozilla has no control over it -- the plugin is a
separate executable which can do things like opening windows, erasing hard
drives, etc.

Comment 2

[joseph brown]

Only seems to affect Netscape and Mozilla; Doesn't repro in IE

Comment 3

[Jesse Ruderman]

Might be a dup of bug 150340, "plugins don't obey the 'Open unrequested windows'
pref".

Comment 4

[Christian :Biesinger (don't email me, ping me on IRC)]

yeah, sounds like bug 150340 to me as well

*** This bug has been marked as a duplicate of 150340 ***