Ovo će web mjesto raditi na ograničen način, dok obavljamo održavanje stranice. Ako neki članak ne riješi tvoj problem i ako želiš postaviti pitanje, naša zajednica za podršku spremna je pomoći na Twitteru @FirefoxSupport i na Redditu /r/firefox.

Pretraži podršku

Izbjegni prevare podrške. Nikad te nećemo tražiti da nas nazoveš, da nam pošalješ telefonski broj ili da podijeliš osobne podatke. Prijavi sumnjive radnje pomoću opcije „Prijavi zlouporabu”.

Saznaj više

Why does Firefox execute Javascript in the referring window's/tab's context when target="_blank" is used with a data:uri?

more options

I set a link's target to _blank. With the href attribute set to a data-uri with a script tag, and the previous window's context executes the javascript. Does this happen with using window.open()? This would allow an attacker with XSS to steal localStorage data, and there is apparently no way for a developer to isolate a window's execution context. My question is, why does a data:uri execute script in the previous window's (i.e the window with the target="_blank" attribute set) context even though it opens in a new tab? And, how is a developer supposed to isolate a window's Javascript context, since _blank doesn't do it?

I set a link's target to _blank. With the href attribute set to a data-uri with a script tag, and the previous window's context executes the javascript. Does this happen with using window.open()? This would allow an attacker with XSS to steal localStorage data, and there is apparently no way for a developer to isolate a window's execution context. My question is, why does a data:uri execute script in the previous window's (i.e the window with the target="_blank" attribute set) context even though it opens in a new tab? And, how is a developer supposed to isolate a window's Javascript context, since _blank doesn't do it?

Izabrano rješenje

JavaScript allows some access between windows (e.g., using the window.opener property from the "child" window).

What is the attack you want to guard against?

Pročitaj ovaj odgovor u kontekstu 👍 0

Svi odgovori (3)

more options

I don't use data URIs, so this may be a dumb question: is Firefox processing your data URI differently than the way it would execute the same code in an onclick handler in the same link?

more options

I think it would be processing it the same way as onclick. The inconsistency here is, a _blank or a _new window implies a new context, but the Javascript runs in the same context that it came from. Is there a secure way to isolate the two windows? (one with the link, and one that just opened by clicking the link)

more options

Odabrano rješenje

JavaScript allows some access between windows (e.g., using the window.opener property from the "child" window).

What is the attack you want to guard against?