410247 - alert, conform, prompt in unload should throw security error

Status: RESOLVED DUPLICATE of bug 391834

(Core :: Security, defect)

Description

[Biju]

At least till bug 61098 not fixed alert(), conform(), prompt() in unload event handler should throw security error. This is a Security and Phishing issue.

Also similar handling needed for print(), <input type=file>.click() and location = "http://anysite/newpage.html";


Reason:-
* Goto http://www.raygoldmodels.com/
* press ctrl+W


PS:credits to bug 410220 reporter

Comment 1

[Magnus Melin [:mkmelin]]

I don't think that's a good idea. onunload is very much used for "good" web applications use cases of asking if the user really want to exit the page.

Comment 2

[Jesse Ruderman]

Magnus, you're probably thinking of the browser's onbeforeunload dialog, which can include *some* text specified by the web site and gives users a chance to cancel leaving the page.  Alerts during onunload are different: they can't let users cancel leaving the page, and I think they're abused more than they're used for "legitimate" purposes.