Closed Bug 560767 Opened 14 years ago Closed 11 years ago

Don't allow navigation/redirection in onbeforeunload

Categories

(Core :: DOM: Core & HTML, enhancement)

enhancement
Not set
normal

Tracking

()

RESOLVED DUPLICATE of bug 956524

People

(Reporter: jruderman, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: sec-want, Whiteboard: [sg:want?])

Attachments

(2 files)

We should probably not allow onbeforeunload to navigate to another page.  If we can prevent navigation entirely while the onbeforeunload dialog is up, that would be even better.

Split from bug 559598.

See also bug 391834, which seeks to disallow alert/prompt/confirm from onbeforeunload.
Note that we do this for onunload... but onbeforeunload happens _very_ early.  Why shouldn't it allow navigation, exactly?
It would be strange and difficult to allow navigation but not allow alerts, for one thing.  (What if the navigated-to page wants to toss up an alert?)

Delaying the navigation until after the dialog goes away is fine.
What "the dialog"?  onbeforeunload doesn't have to pose a dialog, does it?
Oh.  Hmmmmm.  Does it make sense to disallow navigation while the dialog is up, even if the load was initiated before the onbeforeunload event handler returned?
No longer blocks: 559598
OS: Mac OS X → All
Hardware: x86 → All
not a problem for...
  node.setAttribute("onbeforeunload","location='http://google.com';");

But problem when
  node.setAttribute("onbeforeunload","location='http://google.com'; return 1");
Whiteboard: [sg:want?]
Blocks: eviltraps
Summary: Don't allow redirects in onbeforeunload → Don't allow navigation/redirection in onbeforeunload
Attached file evil testcase (difficult to close) (deleted) —
This testcase combines several eviltraps bugs to make itself very difficult to close.  It is reduced from a popup ad I encountered.
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → DUPLICATE
Boris, that bug is private – is this still necessary resp. how long will it stay so?
Flags: needinfo?(bzbarsky)
That's not my call.
Flags: needinfo?(bzbarsky)
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: