619472 - When opening a target=_blank link, "about:blank" appears in URL bar until page loads

Status: VERIFIED DUPLICATE of bug 610357

(Firefox :: Tabbed Browser, defect)

Description

[Jesse Ruderman]

Attachment: testcase

To reproduce: Click a link with target=_blank.

Result: The URL bar in the new tab shows about:blank until the server responds. This is either janky or datalossy, depending on how quickly the server responds.

Expected: The URL bar in the new tab should immediately show the URL to be loaded.

Comment 1

[Jesse Ruderman]

Attachment: testcase with a mix of fast and slow sites

Comment 2

[Michal Zalewski]

Note that showing the URL before the content loads in a new window is dangerous if the attacker can get handle of that window, and if about:blank is same-origin with the opener. You fixed CVE-2010-1206 not long ago:

http://lcamtuf.blogspot.com/2010/06/yeah-about-that-address-bar-thing.html

Even if stopping the navigation is not possible, it's still a rather bad design to show malicious content while URL bar suggests a different origin and the throbber is spinning.

So you should probably either limit this logic to cases where attacker can't get window handle (e.g., target=_blank); or make SOP checks fail against about:blank in this navigation scenario.