Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make target=_blank imply noopener; support opener #4330

Merged
merged 4 commits into from Feb 7, 2019

Conversation

annevk
Copy link
Member

@annevk annevk commented Jan 31, 2019

This reduces the number of coupled top-level browsing contexts and thereby reduces the attack surface somewhat.

Tests: ...

Fixes #4078.


/index.html ( diff )
/links.html ( diff )

This reduces the number of coupled top-level browsing contexts and thereby reduces the attack surface somewhat.

Tests: ...

Fixes #4078.
@annevk
Copy link
Member Author

@annevk annevk commented Jan 31, 2019

This is already implemented by Firefox and Safari (automated tests don't work due to lack of BroadcastChannel).

Chrome: https://bugs.chromium.org/p/chromium/issues/detail?id=927340.

@annevk annevk mentioned this pull request Feb 1, 2019
Copy link
Member

@domenic domenic left a comment

Copypasta is bad; other requests are a bonus.

source Show resolved Hide resolved
source Show resolved Hide resolved
@domenic
Copy link
Member

@domenic domenic commented Feb 2, 2019

Tests for this will be important. It seems like you'll want to test the entire matrix of:

  • noreferrer present vs. absent
  • noopener present vs. absent
  • opener present vs. absent
  • target=_blank vs. target=something else (and maybe vs. no target)

domenic
domenic approved these changes Feb 4, 2019
Copy link
Member

@domenic domenic left a comment

LGTM with nits

source Show resolved Hide resolved
source Show resolved Hide resolved
@annevk annevk merged commit 5c68ab3 into master Feb 7, 2019
2 checks passed
@annevk annevk deleted the annevk/_blank-implies-noopener branch Feb 7, 2019
@annevk annevk added the impacts documentation label Feb 7, 2019
@annevk
Copy link
Member Author

@annevk annevk commented Feb 7, 2019

cc @whatwg/documentation

foolip pushed a commit to web-platform-tests/wpt that referenced this issue Feb 11, 2019
moz-v2v-gh pushed a commit to mozilla/gecko-dev that referenced this issue Feb 21, 2019
…ener support, a=testonly

Automatic update from web-platform-tests
HTML: target=_blank implies noopener; opener support (#15188)

For whatwg/html#4330.
--

wpt-commits: e81ca209b45fbe73c1bb7a20e1c7af51ef46258b
wpt-pr: 15188


--HG--
rename : testing/web-platform/tests/html/semantics/links/links-created-by-a-and-area-elements/support/target_blank_iplicit_noopener.html => testing/web-platform/tests/html/semantics/links/links-created-by-a-and-area-elements/support/target_blank_implicit_noopener.html
mykmelez pushed a commit to mykmelez/gecko that referenced this issue Feb 22, 2019
…ener support, a=testonly

Automatic update from web-platform-tests
HTML: target=_blank implies noopener; opener support (#15188)

For whatwg/html#4330.
--

wpt-commits: e81ca209b45fbe73c1bb7a20e1c7af51ef46258b
wpt-pr: 15188
moz-v2v-gh pushed a commit to mozilla/gecko-dev that referenced this issue Feb 26, 2019
…ener support, a=testonly

Automatic update from web-platform-tests
HTML: target=_blank implies noopener; opener support (#15188)

For whatwg/html#4330.
--

wpt-commits: e81ca209b45fbe73c1bb7a20e1c7af51ef46258b
wpt-pr: 15188


--HG--
rename : testing/web-platform/tests/html/semantics/links/links-created-by-a-and-area-elements/support/target_blank_iplicit_noopener.html => testing/web-platform/tests/html/semantics/links/links-created-by-a-and-area-elements/support/target_blank_implicit_noopener.html
mykmelez pushed a commit to mykmelez/gecko that referenced this issue Feb 27, 2019
…ener support, a=testonly

Automatic update from web-platform-tests
HTML: target=_blank implies noopener; opener support (#15188)

For whatwg/html#4330.
--

wpt-commits: e81ca209b45fbe73c1bb7a20e1c7af51ef46258b
wpt-pr: 15188
gecko-dev-updater pushed a commit to marco-c/gecko-dev-wordified that referenced this issue Oct 3, 2019
…ener support, a=testonly

Automatic update from web-platform-tests
HTML: target=_blank implies noopener; opener support (#15188)

For whatwg/html#4330.
--

wpt-commits: e81ca209b45fbe73c1bb7a20e1c7af51ef46258b
wpt-pr: 15188

UltraBlame original commit: de035411df5175e229feddb7f1cf2f17eeafb872
gecko-dev-updater pushed a commit to marco-c/gecko-dev-comments-removed that referenced this issue Oct 4, 2019
…ener support, a=testonly

Automatic update from web-platform-tests
HTML: target=_blank implies noopener; opener support (#15188)

For whatwg/html#4330.
--

wpt-commits: e81ca209b45fbe73c1bb7a20e1c7af51ef46258b
wpt-pr: 15188

UltraBlame original commit: de035411df5175e229feddb7f1cf2f17eeafb872
gecko-dev-updater pushed a commit to marco-c/gecko-dev-wordified that referenced this issue Oct 4, 2019
…ener support, a=testonly

Automatic update from web-platform-tests
HTML: target=_blank implies noopener; opener support (#15188)

For whatwg/html#4330.
--

wpt-commits: e81ca209b45fbe73c1bb7a20e1c7af51ef46258b
wpt-pr: 15188

UltraBlame original commit: eca5d888e47f18532896f5671d22f463fab67bf5
gecko-dev-updater pushed a commit to marco-c/gecko-dev-wordified-and-comments-removed that referenced this issue Oct 4, 2019
…ener support, a=testonly

Automatic update from web-platform-tests
HTML: target=_blank implies noopener; opener support (#15188)

For whatwg/html#4330.
--

wpt-commits: e81ca209b45fbe73c1bb7a20e1c7af51ef46258b
wpt-pr: 15188

UltraBlame original commit: de035411df5175e229feddb7f1cf2f17eeafb872
gecko-dev-updater pushed a commit to marco-c/gecko-dev-comments-removed that referenced this issue Oct 4, 2019
…ener support, a=testonly

Automatic update from web-platform-tests
HTML: target=_blank implies noopener; opener support (#15188)

For whatwg/html#4330.
--

wpt-commits: e81ca209b45fbe73c1bb7a20e1c7af51ef46258b
wpt-pr: 15188

UltraBlame original commit: eca5d888e47f18532896f5671d22f463fab67bf5
gecko-dev-updater pushed a commit to marco-c/gecko-dev-wordified-and-comments-removed that referenced this issue Oct 4, 2019
…ener support, a=testonly

Automatic update from web-platform-tests
HTML: target=_blank implies noopener; opener support (#15188)

For whatwg/html#4330.
--

wpt-commits: e81ca209b45fbe73c1bb7a20e1c7af51ef46258b
wpt-pr: 15188

UltraBlame original commit: eca5d888e47f18532896f5671d22f463fab67bf5
@matatk
Copy link
Contributor

@matatk matatk commented Nov 2, 2019

Hello. I've been reviewing changes to HTML on behalf of the W3C's Accessible Platform Architectures Working Group, and had some questions about this change.

Regarding the behaviour illustrated in the opener example: if navigation occurs in a different tab or window to the one in which the focus lies, then users of assistive technologies (specifically screen readers or magnifiers) may not be made aware of that navigation in the other tab/window.

I tested in IE 11, Firefox 70 and Chrome 78, with NVDA 2019.2.1 and JAWS 2019, as well as Safari and VoiceOver on macOS Mojave, and found the same behaviour in all combinations of browser and screen-reader:

  • Opening a pop-up link normally (defaults to new tab): the 'pop-up' could control the window.location of its opener, but this was not announced by the screen-reader.
  • Opening the pop-up in a new window: the pop-up could not control its opener.

I realise that this PR only tweaks the implementation, rather than introducing the potential accessibility issues. Further, perhaps this would more naturally fall under the scope of WCAG than the HTML spec. However, I was wondering...

  • Do you feel it may be appropriate to add a note near the example about the accessibility considerations?
  • Would it be helpful if UAs provided notice of navigation in a different browsing context that has been triggered from the current one?
  • Do you feel it should be down to the author of the page to decide if and how to provide that notification?

If the answer is 'yes' to any of the above, and you'd like a PR to amend the wording, I'd be happy to file one.

Other opener-related commits I found in the review: cf483d3 and c0b75ea.

cc @whatwg/a11y

@annevk
Copy link
Member Author

@annevk annevk commented Nov 3, 2019

@matatk I recommend filing a new issue. It's not entirely clear to me what you're suggesting screen reader technology does for noopener vs a normal popup so maybe clarify that there. Also, would you like to join the a11y team?

@matatk
Copy link
Contributor

@matatk matatk commented Nov 7, 2019

Hi @annevk, thanks for your reply. To clarify a bit: I don't think this is a new problem that was introduced by this PR—it seems it was the situation all along, but as I've rarely seen pop-ups that navigate their openers in the wild, I'd not noticed it until I looked into this change.

I'll be AFK for a few days, but when back I'll do a bit more research (as I don't grok why newly-opened windows, as opposed to tabs, can't navigate their opener—I guess this is a facet of multiprocess browsers, but need to check) and make some suggestions in a new issue. If anything, it seems like adding a note about the accessibility implications would be most appropriate, but I'll file the issue and see what you think.

My cycles are somewhat limited, but I'd be happy to join the a11y team and see how it goes; hope I can be of help :-).

kiding added a commit to kiding/content that referenced this issue Feb 10, 2021
See: whatwg/html#4330

Removed the wordings that could imply the behavior is vendor-specific.
Added links to Browser compatibility for easy reference.
rachelandrew pushed a commit to mdn/content that referenced this issue Feb 11, 2021
* <a target="_blank"> has implicit noopener as per spec.
See: whatwg/html#4330

Removed the wordings that could imply the behavior is vendor-specific.
Added links to Browser compatibility for easy reference.

* <a>: Merged the two similar notes, added more links.

* <area> <form>: Applied the same from 517d127 and c531fc3.
Should follow up when browser-compat-data for form is revised.

* <a> <area> <form>: Applied the new note box style.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
addition/proposal impacts documentation normative change topic: hyperlink
Development

Successfully merging this pull request may close these issues.

3 participants