263777 - Click handler bypasses pop-up blocker

Status: RESOLVED WONTFIX

(Core :: DOM: Core & HTML, defect)

Description

[Karsten Düsterloh]

Specifying an onclick handler per onclick attribute or per addEventListener on
document load allows to bypass the pop-up blocker.

(First "exploits" of this are already out in the wild, the given URL opens an
advertizing pop-up when one of the book links is clicked, if cookies are blocked
entirely. It hides this in a very obfuscated code mass.)

Since totally banning onclick handlers isn't quite probable, I suspect more
websites to start with a special front page saying "Click here to enter" and
having a popup opening for every link... :(

Although there are already "exploits" of this out there, I'm marking this bug as
 confidential. The word will get around fast enough without being visible here,
I fear. :(

Comment 1

[Karsten Düsterloh]

Attachment: simple test case

Comment 2

[Johnny Stenback (:jst)]

This is as designed, and it's not really a bug that's fixable either. Short of
AI smarts to figure out what link clicks you want to enable popups from, there's
not much we can do about this. Marking WONTFIX, and opening up, as this is not a
security bug.

Comment 3

[Daniel Veditz [:dveditz] (OOO: back Aug 26)]

*** Bug 263870 has been marked as a duplicate of this bug. ***

Comment 4

[Dan M]

*** Bug 282722 has been marked as a duplicate of this bug. ***

Comment 5

[OstGote!]

*** Bug 265186 has been marked as a duplicate of this bug. ***

Comment 6

[Dan M]

*** Bug 283402 has been marked as a duplicate of this bug. ***