219064 - Popup blocking fails on custom script using setTimeout

Status: RESOLVED FIXED

(SeaMonkey :: UI Design, defect)

Description

[Ido Kanner]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.5b; MultiZilla v1.5.0.1) Gecko/20030827
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.5b; MultiZilla v1.5.0.1) Gecko/20030827

it seems that when the page of 
http://edition.cnn.com/2003/SHOWBIZ/TV/09/12/ritter.obit/index.html is finished
loaded it is able to popup window that the popup blocker does not seem to
identify that it was raised. it seems (inside the site script) that it uses
custom popup window script.
I do not know if can i call it a bug, it might be a new way that sites found how
to popup windows regardless of popup blocker....

Reproducible: Always

Steps to Reproduce:
1.Load the site  http://edition.cnn.com/2003/SHOWBIZ/TV/09/12/ritter.obit/index.html
2. waite for the page finish loading


Actual Results:  
there will be a popup window that the blocker is not detect.

Expected Results:  
find the popup window and disable it popup.

it seems that i'm unable to "tell" the browser to block the new window, i think
this feture shoul be on any new window that the user did not open with the
menu/keyboards.

Comment 1

[Phil Schwartau]

Over to Browser-General component for now. Popup blocking is not done within
JavaScript Engine. 

Compare bug 208753, "Can't block pop-ups that contain only Flash animation"
filed against the same site, although that sounds like a separate issue.

Comment 2

[Joe Infla]

This WFM in mozilla 1.4 release and trunk-2003090710.  Reporter, have you tried
this without Multizilla?

Comment 3

[HJ]

WFM with MultiZilla v1.5.0.3a installed. 

Joe, this bug has *nothing* to do with MultiZilla but with popup blocking.

Comment 4

[Ido Kanner]

Well this problem occured also with a clean copy of mozila (without any 
plugins) what so ever... 

Comment 5

[Joe Infla]

Ido, please start with a clean profile in your clean copy of mozilla and provide
specific steps for reproduction, including how your popup preferences are set,
and when in the process you change them.  For example (in 2003091704):
1. Verify in new profile that prefs-privacy-popups --> block unrequested popups
is unchecked.
2. click link mentioned.
3. wait for page and popup to load.
4. Click in mozilla alert to block popups, then click okay in prefs.
5. reload link.
My results: no popup.  How does this differ from your process?  Please list all
relevant steps and results.

Comment 6

[Ido Kanner]

ok I must admit this is weird...

erlier i was able to repreduce this popup but now it does not occure. i'd even 
removed the popup blocker and still it does not popup any window ... and still 
no popup window was raised.

anyway the popup blocker is activated the "block unrequested popup windows" 
check-box is checked.
and the "display an icon in the navigatior status bar" is also set on active.

please note that this properties was set the same when i'd used the Multizilla.
I will try again this problem using multizilla. i will write here the result. 
if the problem occured with Multizilla i think it safe to close my report (but 
it for you to decide).

Comment 7

[Ido Kanner]

OK, i tested it and i was unable to repreduce the bug again ...

But the MultiZilla version is newer (from thier site) so i do not know what to
say... lets hop it was one time glitch of MultiZilla/Mozilla and it will not
happen again... beacuse i'm trying to find more sites to make this type of "bug"
but i just can not find any :( 

Comment 8

[Joe Infla]

Thanks for trying, Ido.  If you can ever reproduce the bug in the future, please
reopen and attach the code you think may be responsible.  For now, marking WFM.

Comment 9

[Ido Kanner]

Hello,

I'm now working with mozilla 1.5, without any plugins.
The "block unrequested popup window" is set, and the site:
http://doal.co.il:81/login.php does popup a window, and i do not have a menu
option to disable it, and the blocker does not accepts this window as a popup.

i hope it will help to find why/how this problem occured... 

Ido

Comment 10

[Joe Infla]

Attachment: testcase link at comment 9 - implicates setTimeout

this html file is reduced from the link mentioned.  Changing the line
containing setTimeout to just run ld_adv() function directly will block the
popup successfully.

Comment 11

[Joe Infla]

confirming; no clue about the best component, so leaving in BG.

Comment 12

[Peter Ford]

I tried http://edition.cnn.com/2003/SHOWBIZ/TV/09/12/ritter.obit/index.html
The first time there was no sign of any pop ups.  The second time, Mozilla
blocked a pop up _before_ it finished loading the page.

I tried http://doal.co.il:81/login.php
The first time, Mozilla blocked a pop up _after_ it finished loading the page. 
The second time, Mozilla _failed_ to block a pop up _after_ it finished loading
the page.

And FWIW, I've submitted bug 222417 which gives a similar user experience to
this bug but may not have the same cause.

Comment 13

[Joe Infla]

--> XP Apps following example of bug 201595 (and now the owner/QA too...)

Comment 14

[Boris Zbarsky [:bzbarsky]]

Dan -- fun stuff.  The timeout creates a script node, which then starts to
load... So when it loads, we're not inside a timeout and onload has already fired.

Shaver suggested marking script nodes as "tainted" if they start to load any
time when a popup would be blocked.  Then block calls to window.open() that
happen during parsing of a tainted script.

Comment 15

[Dan M]

This is essentially the same as the exploit AOL uses, reported in bug 252326.
It's probably identical in action, though not in the fine details. Shaver's idea
is interesting. Wladimir has proposed a different approach in that bug. He
suggests disabling window.open in general, and making exceptions for cases we
know we want to work.

Comment 16

[Dan M]

Attachment: testcase - appends remotely sourced script element to body element

Let's have a testcase that doesn't load content from a third-party advertiser's
site.

Comment 17

[Ido Kanner]

I wonder if there is a way to know if a user trigger a new window by clicking a
link while distiguish between a non user triggering...
If there is a way to do it, then everything that is not a user trigger is
blocked (unless the user configures otherwise) and it can solve also new ways of
trying to hack this selution (i hope) :)

Comment 18

[Boris Zbarsky [:bzbarsky]]

> I wonder if there is a way to know if a user trigger a new window by clicking a
> link

Not quite yet, no.  Though the right way to go would be to add such a way...

Comment 19

[Ido Kanner]

In my qoury for some perl things, I found a new way to override the popup
blocking  in the site: http://www.sitepoint.com/blog-post-view.php?id=153748.

I check the source and found out two things:

From the file: http://www.sitepoint.com/js/utilities.js

/* XHTML target attribute */
function externalLinks() {
	if (!document.getElementsByTagName) return;
 var anchors = document.getElementsByTagName("a");
 for (var i=0; i<anchors.length; i++) {
   var anchor = anchors[i];
   if (anchor.getAttribute("href") &&
       anchor.getAttribute("rel") == "external") 
       anchor.target = "_blank";
 }
} 

From http://www.sitepoint.com/blog-post-view.php?id=153748:

<script type="text/javascript">

<!-- /* these browsers don't need help with the footer */
window.onload = function() {
	externalLinks();
	};
-->

</script>

Comment 20

[Dan M]

comment 19: Yes thank you for your interest and I'd like to encourage you to
report such things in a proper venue, and discourage you from clogging up a
relatively simple bug report with observations unrelated to the specific bug.
This is not a bug for reporting every unexpected new window one encounters.
Arguably bug 253831 is that. I'd also like to encourage use of search; comment
19 is basically bug 227338.

Comment 21

[Ryan Polk (Quark)]

*** Bug 258084 has been marked as a duplicate of this bug. ***

Comment 22

[OstGote!]

Bug 252326 is fixed, testcase attachment 155655 [details] doesn't work for me anymore. The
popup will be blocked.

Comment 23

[Boris Zbarsky [:bzbarsky]]

Fixed by checkin for bug 252326