2012690 - Ensure felt cannot open new window

Status: RESOLVED FIXED

(Enterprise Products :: General, enhancement)

Description

[:gerard-majax]

openWIndow() needs to be blocked more than in remote/shared/WindowManager.sys.mjs like it is done right now.

Comment 1

[Gian-Carlo Pascutto [:gcp]]

I assume you mean openBrowserWindow but can you be more clear what you mean? There are already isFeltUI() checks in there:
https://searchfox.org/enterprise-main/source/remote/shared/WindowManager.sys.mjs#357

Comment 2

[:gerard-majax]

(In reply to Gian-Carlo Pascutto [:gcp] from comment #1)

I assume you mean openBrowserWindow but can you be more clear what you mean? There are already isFeltUI() checks in there:
https://searchfox.org/enterprise-main/source/remote/shared/WindowManager.sys.mjs#357

Yes, there is this check but it's only for the remote webdriver things. I filed the issue while doing it, to make sure we dont let other ways to open new window in felt doable. This needs to be done carefully as e.g. we want to allow browser console etc.

Comment 3

[:gerard-majax]

We may want to be able to open new windows, for e.g. jsconsole when needed. There is also the SSO/Duo flow that may have documenation the user has to read. We can probably mitigate escape risks here by making any window open being a minimalist popup

Comment 4

[:gerard-majax]

Attachment: Duo documentation opened with fix

Comment 5

[:gerard-majax]

Attachment: Duo documentation opened without the fix

Comment 6

[BMO Github Automation]

Attachment: [mozilla/enterprise-firefox] Bug 2012690 - Enterprise: limit new windows on FELT (#710)

Comment 7

[BMO Github Automation]

Attachment: [mozilla/enterprise-firefox] Bug 2012690 - Enterprise: limit new windows on FELT (#711)

Comment 8

[:gerard-majax]

OK maybe we want to cover also for https://searchfox.org/firefox-main/rev/837d45e6097990d3144b6769e8dd574d23e74def/browser/base/content/browser.js#1685-1701

Comment 10

[BMO Github Automation]

Authored by Alexandre Lissy
https://github.com/mozilla/enterprise-firefox/commit/417d9aa57b37fc4c6b87838917f30390e82225ce
[enterprise-main] Bug 2012690 - Enterprise: limit new windows on FELT

Authored by https://github.com/lissyx
https://github.com/mozilla/enterprise-firefox/commit/efe2bcb0cfa294843b1433340af6f5ad5d1d91f1
[enterprise-main] Merge pull request #710 from lissyx/enterprise-bug2012690_limit_new_windows