1946606 - Fx 135 regression: bookmarklet fails to open more than one tab despite dom.block_multiple_popups=false

Status: NEW

(Core :: DOM: Core & HTML, defect)

Description

[ephbase-moz]

Steps to reproduce:

1. new profile
2. set dom.block_multiple_popups=false
3. add a bookmarklet: javascript:open('https://example.org/?1');void open('https://example.org/?2');
4. open a new tab
5. click on the bookmarklet or invoke it by keyword

Actual results:

• only one tab is opened (first url)
• an alert is shown on the tab where the bookmarklet was invoked: "Firefox prevented this site form opening a pop-up window."

Expected results:

dom.block_multiple_popups=false should allow a bookmarklet to open multiple tabs, as it did in 134.0.2

Comment 1

[ephbase-moz]

johannh, in bug 1524137 you suggested dom.block_multiple_popups=false to allow multiple tab opening bookmarklets to work.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Redirect a needinfo that is pending on an inactive user to the triage owner.
:masayuki, since the bug has recent activity, could you have a look please?

For more information, please visit BugBot documentation.

Comment 3

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(Away until 6/30 except 24)]

Redirecting to Edgar since the pref was removed by Edgar in bug 1933321.

Comment 4

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(Away until 6/30 except 24)]

(Anyway, I think that we don't need to block the popups coming from bookmarklet.)

Comment 5

[ephbase-moz]

(In reply to Masayuki Nakano [:masayuki] (he/him)(JST, +0900) from comment #4)

(Anyway, I think that we don't need to block the popups coming from bookmarklet.)

Of course. Only a user can invoke a bookmarklet, either by a click or a keyword. Blocking user requested tabs is clear failure of popup blocking, which is intended for unsolicited popups. That's what Bug 1524137 is about. But it was never addressed, only a workaround was suggested, which now doesn't work.

Comment 6

[Edgar Chen [:edgar]]

Yes, we could try to use LOAD_FLAGS_ALLOW_POPUPS to bypass the popup blocker.

Comment 7

[Edgar Chen [:edgar]]

Oh, we do try to handle it for bookmarklet, see https://searchfox.org/mozilla-central/rev/2a69486ab1df00b1ea8ecd14027e2cc6c0415ed0/docshell/base/nsDocShell.cpp#718-725. But the user activation will be consumed for the first window.open(), so the second window.open() is blocked. The difficulty is that window.open() is called from script doesn't know about the internal load flag, and the PopupBlockerState is used for that, we could make it work again. But that means we could not remove PopupBlockerState entirely, need to keep it to handle some special cases.

Comment 8

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(Away until 6/30 except 24)]

I wonder, cannot Window.open be marked as NeedsSubjectPrincipal and check the principal to ignore the popup blocker? Although I don't know the principal of bookmarklet script.

Comment 9

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1933321

Comment 10

[Edgar Chen [:edgar]]

(In reply to Masayuki Nakano [:masayuki] (he/him)(JST, +0900) from comment #8)

I wonder, cannot Window.open be marked as NeedsSubjectPrincipal and check the principal to ignore the popup blocker? Although I don't know the principal of bookmarklet script.

Unfortunately, this doesn’t work because, in this case, it is essentially the same as navigating the current tab to a JavaScript URI, which runs the script in the current tab, see https://searchfox.org/mozilla-central/rev/405d0b26a98dec92d8009b38a8ad1c1609475f1e/dom/jsurl/nsJSProtocolHandler.cpp#355-361. The triggering principal would be system principal, but window.open doesn't know about that.

Comment 11

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1933321