1814019 - Can get the current website's address to the new about:blank window

Status: RESOLVED INVALID

(Core :: DOM: Core & HTML, defect)

Description

[Khiem Tran]

On Firefox 109.0 (64-bit) on macOS Ventura 13.1:

Create an online .html file with:

	<button id="openPopup">Open a popup</button>
	<br><br>
	<button id="lockPointer">Lock the pointer</button>
	<script>
		let openedWindow = null;
		const openPopup = document.getElementById("openPopup");
		openPopup.addEventListener("click", () => {
			oWindow = window.open("about:blank", "", "menubar=no,width=100,height=100,left=200,top=200");
		});
		const lockPointer = document.getElementById("lockPointer");
		lockPointer.addEventListener("click", () => {
			oWindow.focus();
			oWindow.resizeTo(10000,10000);
			setTimeout(() => {
				document.body.requestPointerLock();
				oWindow.document.write("Hello!");
			}, 200)
		});
	</script>

For example:

https://thisblogtests.blogspot.com/2023/01/open-popup-lock-pointer-document.html.

Load this online .html file on Firefox, click Open a popup once, an about:blank window is opened, click Lock the pointer twice, you will see the address of the current website, for example: https://thisblogtests.blogspot.com/2023/01/open-popup-lock-pointer-document.html, is gotten to the new window opened (which is an about:blank new window).

Comment 1

[Andrew McCreight [:mccr8]]

I can confirm the behavior as described, but I'm not sure how it is a security issue. I may be missing something.

Comment 2

[Andrew McCreight [:mccr8]]

Attachment: test case from comment 0

Comment 3

[Daniel Veditz [:dveditz]]

Why do you think this is a security bug? I think I've gotten lost in your description. "about:blank" is an artificial name, but those documents are "owned" by the document that created them. Internally that is the URL of the content.

I would expect Chrome to behave the same more or less.

Comment 4

[Andrew McCreight [:mccr8]]

This is working the way it is supposed to. Nika said that window.location is updated in both Chrome and Firefox, but Chrome doesn't update the URL bar for whatever reason. Doesn't seem like a sec bug.