Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

Hierdie gesprek is in die argief. Vra asseblief 'n nuwe vraag as jy hulp nodig het.

Why does Firefox execute Javascript in the referring window's/tab's context when target="_blank" is used with a data:uri?

more options

I set a link's target to _blank. With the href attribute set to a data-uri with a script tag, and the previous window's context executes the javascript. Does this happen with using window.open()? This would allow an attacker with XSS to steal localStorage data, and there is apparently no way for a developer to isolate a window's execution context. My question is, why does a data:uri execute script in the previous window's (i.e the window with the target="_blank" attribute set) context even though it opens in a new tab? And, how is a developer supposed to isolate a window's Javascript context, since _blank doesn't do it?

I set a link's target to _blank. With the href attribute set to a data-uri with a script tag, and the previous window's context executes the javascript. Does this happen with using window.open()? This would allow an attacker with XSS to steal localStorage data, and there is apparently no way for a developer to isolate a window's execution context. My question is, why does a data:uri execute script in the previous window's (i.e the window with the target="_blank" attribute set) context even though it opens in a new tab? And, how is a developer supposed to isolate a window's Javascript context, since _blank doesn't do it?

Gekose oplossing

JavaScript allows some access between windows (e.g., using the window.opener property from the "child" window).

What is the attack you want to guard against?

Lees dié antwoord in konteks 👍 0

All Replies (3)

more options

I don't use data URIs, so this may be a dumb question: is Firefox processing your data URI differently than the way it would execute the same code in an onclick handler in the same link?

more options

I think it would be processing it the same way as onclick. The inconsistency here is, a _blank or a _new window implies a new context, but the Javascript runs in the same context that it came from. Is there a secure way to isolate the two windows? (one with the link, and one that just opened by clicking the link)

more options

Gekose oplossing

JavaScript allows some access between windows (e.g., using the window.opener property from the "child" window).

What is the attack you want to guard against?