377069 - Javascript can close browser window without confirmation

Status: RESOLVED DUPLICATE of bug 212298

(Firefox :: Security, defect)

Description

[JoE]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; hu; rv:1.8.0.11) Gecko/20070312 Firefox/1.5.0.11
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; hu; rv:1.8.0.11) Gecko/20070312 Firefox/1.5.0.11

Specially crafted javascript closes the current tab/window without any notification:

<script language=javascript>
  window.open('','_parent','');
  window.close();
</script>

Window names _parent, _top, _self can close the current page.


Reproducible: Always

Steps to Reproduce:
Just open a html file which contains the above JS snippet.

Actual Results:  
1. Current tab closed.
2. Only one tab -> browser closed.


Expected Results:  
blocking, confirmation, warning, etc.

Comment 1

[Dave Townsend [:mossop]]

Attachment: Testcase from initial comment

Comment 2

[Dave Townsend [:mossop]]

I'm unable to reproduce this with the given testcase in Firefox 2 or 3.0a3. Joe, can you retest in Firefox 2?

Comment 3

[WADA:World Anti-bad-Duping Agency]

DUP of Bug 266371? See also bugs in dependency tree and DUPs of them.  

Comment 4

[[:Aleksej]]

Maybe not exactly, but I'll try…