ScCN/scratch-vm
2
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Always force noreferrer when opening new windows

Browse Source
This commit is contained in:
GarboMuffin committed 2023-05-26 22:32:03 -05:00
1 parent c4561c2f1c
commit ea81f29955
2 files changed
+5 -2
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

src/extension-support/tw-unsandboxed-extension-runner.js
+3
View File
@@ -97,6 +97,9 @@ const setupUnsandboxedExtensionAPI = vm => new Promise(resolve => {
if (!await Scratch.canOpenWindow(url)) {
throw new Error(`Permission to open tab ${url} rejected.`);
}
// Use noreferrer to prevent new tab from accessing `window.opener`
const baseFeatures = 'noreferrer';
features = features ? `${baseFeatures},${features}` : baseFeatures;
return window.open(url, '_blank', features);
};
test/unit/tw_unsandboxed_extensions.js
+2 -2
View File
@@ -218,8 +218,8 @@ test('openWindow', async t => {
UnsandboxedExtensionRunner.setupUnsandboxedExtensionAPI(vm);
global.Scratch.canOpenWindow = url => url === 'https://example.com/2';
await t.rejects(global.Scratch.openWindow('https://example.com/1'), /Permission to open tab https:\/\/example.com\/1 rejected/);
t.equal(await global.Scratch.openWindow('https://example.com/2'), '[Window https://example.com/2 target=_blank features=]');
t.equal(await global.Scratch.openWindow('https://example.com/2', 'popup=1'), '[Window https://example.com/2 target=_blank features=popup=1]');
t.equal(await global.Scratch.openWindow('https://example.com/2'), '[Window https://example.com/2 target=_blank features=noreferrer]');
t.equal(await global.Scratch.openWindow('https://example.com/2', 'popup=1'), '[Window https://example.com/2 target=_blank features=noreferrer,popup=1]');
t.end();
});