Make target=_blank imply noopener; support opener #4330

annevk · 2019-01-31T15:35:26Z

This reduces the number of coupled top-level browsing contexts and thereby reduces the attack surface somewhat.

Tests: ...

/index.html ( diff )
/links.html ( diff )

This reduces the number of coupled top-level browsing contexts and thereby reduces the attack surface somewhat. Tests: ... Fixes #4078.

For whatwg/html#4330.

annevk · 2019-01-31T15:52:15Z

This is already implemented by Firefox and Safari (automated tests don't work due to lack of BroadcastChannel).

Chrome: https://bugs.chromium.org/p/chromium/issues/detail?id=927340.

domenic

Copypasta is bad; other requests are a bonus.

source

domenic · 2019-02-02T00:43:51Z

Tests for this will be important. It seems like you'll want to test the entire matrix of:

noreferrer present vs. absent
noopener present vs. absent
opener present vs. absent
target=_blank vs. target=something else (and maybe vs. no target)

domenic

LGTM with nits

source

annevk · 2019-02-07T12:38:40Z

cc @whatwg/documentation

For whatwg/html#4330.

…ener support, a=testonly Automatic update from web-platform-tests HTML: target=_blank implies noopener; opener support (#15188) For whatwg/html#4330. -- wpt-commits: e81ca209b45fbe73c1bb7a20e1c7af51ef46258b wpt-pr: 15188 --HG-- rename : testing/web-platform/tests/html/semantics/links/links-created-by-a-and-area-elements/support/target_blank_iplicit_noopener.html => testing/web-platform/tests/html/semantics/links/links-created-by-a-and-area-elements/support/target_blank_implicit_noopener.html

…ener support, a=testonly Automatic update from web-platform-tests HTML: target=_blank implies noopener; opener support (#15188) For whatwg/html#4330. -- wpt-commits: e81ca209b45fbe73c1bb7a20e1c7af51ef46258b wpt-pr: 15188

…ener support, a=testonly Automatic update from web-platform-tests HTML: target=_blank implies noopener; opener support (#15188) For whatwg/html#4330. -- wpt-commits: e81ca209b45fbe73c1bb7a20e1c7af51ef46258b wpt-pr: 15188 --HG-- rename : testing/web-platform/tests/html/semantics/links/links-created-by-a-and-area-elements/support/target_blank_iplicit_noopener.html => testing/web-platform/tests/html/semantics/links/links-created-by-a-and-area-elements/support/target_blank_implicit_noopener.html

…ener support, a=testonly Automatic update from web-platform-tests HTML: target=_blank implies noopener; opener support (#15188) For whatwg/html#4330. -- wpt-commits: e81ca209b45fbe73c1bb7a20e1c7af51ef46258b wpt-pr: 15188

…ener support, a=testonly Automatic update from web-platform-tests HTML: target=_blank implies noopener; opener support (#15188) For whatwg/html#4330. -- wpt-commits: e81ca209b45fbe73c1bb7a20e1c7af51ef46258b wpt-pr: 15188 UltraBlame original commit: de035411df5175e229feddb7f1cf2f17eeafb872

…ener support, a=testonly Automatic update from web-platform-tests HTML: target=_blank implies noopener; opener support (#15188) For whatwg/html#4330. -- wpt-commits: e81ca209b45fbe73c1bb7a20e1c7af51ef46258b wpt-pr: 15188 UltraBlame original commit: eca5d888e47f18532896f5671d22f463fab67bf5

…ener support, a=testonly Automatic update from web-platform-tests HTML: target=_blank implies noopener; opener support (#15188) For whatwg/html#4330. -- wpt-commits: e81ca209b45fbe73c1bb7a20e1c7af51ef46258b wpt-pr: 15188 UltraBlame original commit: de035411df5175e229feddb7f1cf2f17eeafb872

…ener support, a=testonly Automatic update from web-platform-tests HTML: target=_blank implies noopener; opener support (#15188) For whatwg/html#4330. -- wpt-commits: e81ca209b45fbe73c1bb7a20e1c7af51ef46258b wpt-pr: 15188 UltraBlame original commit: eca5d888e47f18532896f5671d22f463fab67bf5

matatk · 2019-11-02T00:55:35Z

Hello. I've been reviewing changes to HTML on behalf of the W3C's Accessible Platform Architectures Working Group, and had some questions about this change.

Regarding the behaviour illustrated in the opener example: if navigation occurs in a different tab or window to the one in which the focus lies, then users of assistive technologies (specifically screen readers or magnifiers) may not be made aware of that navigation in the other tab/window.

I tested in IE 11, Firefox 70 and Chrome 78, with NVDA 2019.2.1 and JAWS 2019, as well as Safari and VoiceOver on macOS Mojave, and found the same behaviour in all combinations of browser and screen-reader:

Opening a pop-up link normally (defaults to new tab): the 'pop-up' could control the window.location of its opener, but this was not announced by the screen-reader.
Opening the pop-up in a new window: the pop-up could not control its opener.

I realise that this PR only tweaks the implementation, rather than introducing the potential accessibility issues. Further, perhaps this would more naturally fall under the scope of WCAG than the HTML spec. However, I was wondering...

Do you feel it may be appropriate to add a note near the example about the accessibility considerations?
Would it be helpful if UAs provided notice of navigation in a different browsing context that has been triggered from the current one?
Do you feel it should be down to the author of the page to decide if and how to provide that notification?

If the answer is 'yes' to any of the above, and you'd like a PR to amend the wording, I'd be happy to file one.

Other opener-related commits I found in the review: cf483d3 and c0b75ea.

cc @whatwg/a11y

annevk · 2019-11-03T17:51:17Z

@matatk I recommend filing a new issue. It's not entirely clear to me what you're suggesting screen reader technology does for noopener vs a normal popup so maybe clarify that there. Also, would you like to join the a11y team?

matatk · 2019-11-07T09:58:55Z

Hi @annevk, thanks for your reply. To clarify a bit: I don't think this is a new problem that was introduced by this PR—it seems it was the situation all along, but as I've rarely seen pop-ups that navigate their openers in the wild, I'd not noticed it until I looked into this change.

I'll be AFK for a few days, but when back I'll do a bit more research (as I don't grok why newly-opened windows, as opposed to tabs, can't navigate their opener—I guess this is a facet of multiprocess browsers, but need to check) and make some suggestions in a new issue. If anything, it seems like adding a note about the accessibility implications would be most appropriate, but I'll file the issue and see what you think.

My cycles are somewhat limited, but I'd be happy to join the a11y team and see how it goes; hope I can be of help :-).

See: whatwg/html#4330 Removed the wordings that could imply the behavior is vendor-specific. Added links to Browser compatibility for easy reference.

* <a target="_blank"> has implicit noopener as per spec. See: whatwg/html#4330 Removed the wordings that could imply the behavior is vendor-specific. Added links to Browser compatibility for easy reference. * <a>: Merged the two similar notes, added more links. * <area> <form>: Applied the same from 517d127 and c531fc3. Should follow up when browser-compat-data for form is revised. * <a> <area> <form>: Applied the new note box style.

refer whatwg/html#4330 https://mathiasbynens.github.io/rel-noopener/

Make target=_blank imply noopener; support opener

60f8262

This reduces the number of coupled top-level browsing contexts and thereby reduces the attack surface somewhat. Tests: ... Fixes #4078.

annevk added a commit to web-platform-tests/wpt that referenced this pull request Jan 31, 2019

HTML: target=_blank implies noopener; opener support

75d874a

For whatwg/html#4330.

annevk mentioned this pull request Jan 31, 2019

HTML: target=_blank implies noopener; opener support web-platform-tests/wpt#15188

Merged

<3 travis

39e0144

annevk mentioned this pull request Feb 1, 2019

Support <form rel> #4332

Merged

domenic requested changes Feb 2, 2019

View reviewed changes

source Show resolved Hide resolved

source Show resolved Hide resolved

domenic added topic: hyperlink normative change addition/proposal New features or enhancements labels Feb 2, 2019

add an example and pm link and fix copypasta

321ed55

domenic approved these changes Feb 4, 2019

View reviewed changes

source Show resolved Hide resolved

source Show resolved Hide resolved

nits

04f3413

annevk merged commit 5c68ab3 into master Feb 7, 2019

annevk deleted the annevk/_blank-implies-noopener branch February 7, 2019 12:24

annevk added the impacts documentation Used by documentation communities, such as MDN, to track changes that impact documentation label Feb 7, 2019

CYBAI mentioned this pull request Feb 7, 2019

Make target=_blank imply noopener; support opener servo/servo#22845

Closed

foolip pushed a commit to web-platform-tests/wpt that referenced this pull request Feb 11, 2019

HTML: target=_blank implies noopener; opener support (#15188)

e81ca20

For whatwg/html#4330.

matatk mentioned this pull request Nov 2, 2019

HTML Standard (Jul 2019): review tracker w3c/htmlwg#5

Open

8 tasks

hober mentioned this pull request Dec 10, 2019

HTML horizontal review: Security w3ctag/design-reviews#451

Closed

4 tasks

Chocobo1 mentioned this pull request Feb 18, 2020

Use IP geolocation database by DB-IP instead of MaxMind qbittorrent/qBittorrent#12014

Merged

DirtyF mentioned this pull request Mar 12, 2020

New Tab Option tinacms/tinacms#876

Closed

matatk mentioned this pull request Apr 17, 2020

Accessibility of window.opener navigation #5464

Open

annevk mentioned this pull request Jul 6, 2020

Ability to prevent tabnabbing with the referrer-policy header w3c/webappsec-referrer-policy#141

Closed

jdm mentioned this pull request Jul 22, 2020

Implemented get element target algorithm servo/servo#27299

Merged

5 tasks

aszx87410 mentioned this pull request Sep 5, 2020

從 SessionStorage 開始一場 spec 之旅 aszx87410/blog#62

Open

zac1st1k mentioned this pull request Oct 19, 2020

Track rel=noopener support MicrosoftEdge/Status#450

Open

mems mentioned this pull request Dec 11, 2020

Update anchor and area support of target=_blank imply rel=noopener mdn/browser-compat-data#7642

Merged

wesinator mentioned this pull request Mar 13, 2021

Link types: noopener - add note about new default mdn/content#3089

Merged

whurd-redcanary mentioned this pull request Mar 13, 2021

:auto_link => target=_blank vmg/redcarpet#85

Closed

songhn233 mentioned this pull request Apr 13, 2021

update(zh-cn): target=_blank implicit noopener mdn/translated-content#499

Merged

Chocobo1 mentioned this pull request Aug 1, 2021

Disconnect comment links fom the WebUI qbittorrent/qBittorrent#15251

Merged

tianheg pushed a commit to tianheg/blog that referenced this pull request May 6, 2022

when setting target="_blank" no needed rel="noopener"

e5d552c

refer whatwg/html#4330 https://mathiasbynens.github.io/rel-noopener/

tianheg mentioned this pull request May 6, 2022

no needed rel="noopener" when setting target="_blank" reuixiy/hugo-theme-meme#379

Closed

This comment was marked as off-topic.

Sign in to view

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Make target=_blank imply noopener; support opener #4330

Make target=_blank imply noopener; support opener #4330

annevk commented Jan 31, 2019 •

edited by pr-preview bot

annevk commented Jan 31, 2019

domenic left a comment

domenic commented Feb 2, 2019

domenic left a comment

annevk commented Feb 7, 2019

matatk commented Nov 2, 2019

annevk commented Nov 3, 2019

matatk commented Nov 7, 2019

This comment was marked as off-topic.

Make target=_blank imply noopener; support opener #4330

Make target=_blank imply noopener; support opener #4330

Conversation

annevk commented Jan 31, 2019 • edited by pr-preview bot

annevk commented Jan 31, 2019

domenic left a comment

Choose a reason for hiding this comment

domenic commented Feb 2, 2019

domenic left a comment

Choose a reason for hiding this comment

annevk commented Feb 7, 2019

matatk commented Nov 2, 2019

annevk commented Nov 3, 2019

matatk commented Nov 7, 2019

This comment was marked as off-topic.

annevk commented Jan 31, 2019 •

edited by pr-preview bot