window.open('url', '', 'noopener') always opens in a modal popup
Reported by
bobvanto...@adrime.com,
Mar 18 2016
|
|||||||||
Issue description
UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.87 Safari/537.36
Steps to reproduce the problem:
The problem can be reproduced by making a call to `window.open('url','','noopener');`
Alternatively you can use the code pen below to reproduce the problem:
http://codepen.io/bobvt/pen/rejQbQ
Additional HTML example:
``` html
<ul>
<li>
<a href="https://html.spec.whatwg.org/multipage/semantics.html#link-type-noopener" target="_blank" rel="noopener">rel=noopener</a>
</li>
<li>
<a href="#" id="windowOpenLinkNoopener">window.open with noopener</a>
</li>
<li>
<a href="#" id="windowOpenLink">window.open without noopener</a>
</li>
</ul>
```
``` js
document.getElementById('windowOpenLinkNoopener').addEventListener('click', function() {
window.open('https://html.spec.whatwg.org/multipage/semantics.html#link-type-noopener', '', 'noopener');
});
document.getElementById('windowOpenLink').addEventListener('click', function() {
window.open('https://html.spec.whatwg.org/multipage/semantics.html#link-type-noopener', '', '');
});
```
What is the expected behavior?
The tab should open in a new window.
What went wrong?
Instead, the tab opens as a popup modal, whenever anything is added to the third parameter of `window.open`.
Did this work before? No
Chrome version: 49.0.2623.87 Channel: stable
OS Version: 15.10
Flash Version: Shockwave Flash 21.0 r0
As you can see in the sample, the anchor element with `rel=noopener` applied to it simply opens the url in a new tab, as is expected.
,
Mar 21 2016
Able to repro this issue on Windows 7, MAC (10.11.3) & Ubuntu Trusty (14.04) for Google Chrome Stable Version - 49.0.2623.87 This is a Non-Regression issue existing from M30 - # - 30.0.1549.0
,
Mar 21 2016
,
Aug 17 2017
This bug basically prevents me from being able to use "noopener" because I really don't want model popup windows. I want.. no I *need* a tab :) Any news on this? It's been >= year..
,
Aug 30 2017
Checking back in after being reminded of this issue. I created a codepen example that illustrates the problem: https://codepen.io/rejh/pen/WEYmpz Hope this helps getting this back on the radar. Replacing all window.open() calls with <a> is not always an option.
,
Aug 30 2017
@mkwst: does this warrant higher priority as it causes devs to avoid a security benefit?
,
Aug 31 2017
`window.open` kinda falls between some cracks in our triage structure (is "WindowDialog" even the right component?). :/ Since 62 is branching today, let's try to get this fixed for 63. I'm about to be OOO for a week, but perhaps creis@ and/or dcheng@ might be able to find someone to poke at this? I imagine we'd be able to come up with reasonable behavior.
,
Jun 15 2018
Just stumbled across it as I hit this bug and went to file it. If this is really a P1 it should probably have an owner. :)
,
Jun 15 2018
👍 thanks ;)
,
Jun 20 2018
Sorry, our team really has zero cycles for this right now, though I agree it's a bug that should be fixed. I agree with Mike that this falls into a relatively unowned area, so I don't know who to recommend to work on it. Maybe someone else in the Navigation component can volunteer? Marking available, since it will just sit in my queue otherwise.
,
Jun 20 2018
,
Sep 19
Unsurprisingly, this also affects noreferrer
,
Oct 20
Any news? It's been a while ;)
,
Nov 20
Can we nudge this please? I hear you at #10 that you have no cycles, but I'm hoping this could be a relatively quick win if we can figure out the best team to look at it.
,
Nov 20
I think it's actually possible to make window.open() with noopener to open a new tab instead of a popup, if you specify the right things in the third parameter. For your codepen example, this seems to do it:
window.open('https://html.spec.whatwg.org/multipage/semantics.html#link-type-noopener','_blank','toolbar=1,menubar=1,location=1,status=1,scrollbars=1,noopener');
(Credit to dcheng@, who gave this tip to me a while ago.) We should still look into changing the default behavior, which I agree isn't ideal, but at least this might be a workaround in the meantime.
,
Nov 20
@ #15 & dcheng@ - thanks for the workaround. Be good to get this an owner soon.
,
Nov 21
@c#14: heh that seems to work. Thanks! Also looking forward for Chrome doing this by default :) |
|||||||||
►
Sign in to add a comment |
|||||||||
Comment 1 by cbiesin...@chromium.org
, Mar 18 2016