220118 - Let user block scripts from changing window.location on onload or timer (disable automatic JavaScript redirection, lock on current page)

Status: NEW

(Core :: DOM: Core & HTML, enhancement, P3)

Description

[Damian Yerrick]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5b) Gecko/20030917
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5b) Gecko/20030917

Some web sites have JavaScript code that detects whether or not a page
appears in its proper frameset environment, but after a reorganization
of the site without corresponding changes to the code, the code actually
redirects to a non-existent (404) page.  This affects me often when I
read pages from dead sites using Google's cache.

Other web sites are subscription sites that are dumb enough to send the
entire article to the client (so that the article shows up in search engines)
but use JavaScript to redirect non-members to the "buy a subscription" page.

I'd like to see Mozilla let the user control whether or not scripts can
automatically change the location.

Reproducible: Always

Steps to Reproduce:
1. Open the test case URL
2. Follow one of the Experimental group links
3. Get redirected to the page marked as "Highway Robbery" in the Control group
4. Open Preferences > Advanced > Scripts & Plugins

Actual Results:  
Lack of a checkbox to block automatic JavaScript redirects.

Expected Results:  
Preferences should have given me a way to block automatic JavaScript redirects.

This is like bug 83265 except dealing with automatically triggered JavaScript
'document.location' changes instead of HTTP headers or <meta http-equiv />.

Comment 1

[Damian Yerrick]

Attachment: Local copy of test case from pinocchio.jk0.org

The machine 'pinocchio.jk0.org' is a workstation that is powered off
during severe weather.	Here's a tarball of the test case.

Comment 2

[Gota]

Please get this one implemented! Firefox really needs this, and there appears to be no extension to do this. :(

Comment 3

[:aceman]

What about the noscript extension? That would block more than just redirects.

Comment 4

[BRDTO]

I second that! Browser must obey "warn me if page tries to redirect..." user preference. Currently it can be easily bypassed using JavaScript window.location.
I suggest a community to promote this bug.

Comment 5

[Damian Yerrick]

A "tab-under" is a click handler that clones the current page into a new tab and focuses that tab while redirecting the old tab to an advertisement. The inconvenient part about a tab-under is that if the user closes the ad tab, the user loses that tab's back button history, such as the search engine, social timeline, or citing document from which the user arrived at the page's URL. With tab-under behavior on the rise, other browsers are building mechanisms to block it, such as Chrome.

https://tech.slashdot.org/story/17/10/03/1837202/google-chrome-will-block-tab-under-behavior

So can this be considered a Chrome parity bug?