837791 - window.open("javascript… opens window with URL shown as "about:blank". // Fake site with URL about:blank

Status: NEW

(Core :: DOM: Core & HTML, defect)

Description

[Boev Vadim Aleksandrovich]

Attachment: exploit.htm

User Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.57 Safari/537.17

Steps to reproduce:

If the method window.open put URL type "javascript:" window will be opened URL "about: blank", which can confuse the user and recognizes them as brakes browser.


Actual results:

In the open window URL "about: blank" with html


Expected results:

In the open window URL "javascript:...."

Comment 1

[Boev Vadim Aleksandrovich]

This is not just incorrect display URL, ie "about: blank", which is very dangerous if suddenly you can display the file in the "about: blank" it will lead to the theft of the file.

Comment 2

[[:Aleksej]]

Confirmed with 2013-02-04-03-09-41-mozilla-central-firefox-21.0a1.ru.linux-x86_64

Regression range:

WFM: 2008-11-15-01-mozilla-central-firefox-3.1b2pre.en-US.linux-x86_64
WFM: 2008-11-18-01-mozilla-central-firefox-3.1b2pre.en-US.linux-x86_64
bug: 2008-11-19-15-mozilla-central-firefox-3.1b2pre.en-US.linux-x86_64
bug: 2008-11-20-10-mozilla-central-firefox-3.1b2pre.en-US.linux-x86_64

https://hg.mozilla.org/mozilla-central/pushloghtml?startdate=2008-11-18&enddate=2008-11-19+16


Maybe related to bug 610001 or bug 792532?

Comment 3

[Boev Vadim Aleksandrovich]

Firefox version 24

Bug still relevant.

Comment 4

[[:Aleksej]]

Reproduced with 2013-10-01-03-02-04-mozilla-central-firefox-27.0a1.en-US.linux-x86_64.  The bug's version field is for the first affected version.

Comment 5

[Alex Keybl [:akeybl]]

Tracking is not for year old bugs.

Comment 6

[Boev Vadim Aleksandrovich]

Firefox version 28.0

Bug still relevant.