Does Pale Moon have support for the rel="noopener" attribute?

Talk about code development, features, specific bugzilla bugs, enhancements, patches, and other highly technical things.

Moderators: Indalecio, satrow

Forum rules
Please keep everything here strictly on-topic.
This board is meant for Pale Moon source code development related subjects only like code snippets, patches, specific referenced Bugzilla bugs, mercurial, etc.

This is not for tech support! Please do not post tech support questions in the "Development" board!
Please make sure not to use this board for support questions. Most "bug reports" do not belong in this board and should initially be posted in Community Support or other relevant support boards.

Please keep things on-topic as this forum will be used for reference for Pale Moon development. Expect topics that aren't relevant as such to be moved or deleted.
User avatar
half-moon
Astronaut
Astronaut
Posts: 898
Joined: Sun Jul 20, 2014 12:30 pm
Location: USA

Does Pale Moon have support for the rel="noopener" attribute?

Postby half-moon » Tue Jan 24, 2017 4:40 pm

Does Pale Moon have support for the rel="noopener" attribute? It would certainly improve browser security if it does.

User avatar
Andrew Gilbertson
Fanatic
Fanatic
Posts: 237
Joined: Thu Jul 16, 2015 1:43 pm
Location: US/Tampa

Re: Does Pale Moon have support for the rel="noopener" attribute?

Postby Andrew Gilbertson » Tue Jan 24, 2017 6:26 pm

half-moon wrote:Does Pale Moon have support for the rel="noopener" attribute? It would certainly improve browser security if it does.


I found this page describing the feature: https://mathiasbynens.github.io/rel-noopener/

The problem with this is that you'd have to apply this to every link on the web...except those that you actually want to have control over other tabs/windows, which then leads to potential issues with managing lists (whether that's whitelists, blacklists, or graylists depends on the implementation). I'm not going to go so far as to say that this is a bad idea, but I will say that it sounds like a good candidate for being handled by an extension that will either block these types of requests, or prompt to allow them, rather than being a core browser feature. And it turns out that there are already extensions that handle it: NoScript blocks this and Request Policy Continued prompts whether or not to allow the redirect.

User avatar
0strodamus
Moon lover
Moon lover
Posts: 83
Joined: Wed Nov 19, 2014 7:48 pm
Location: US

Re: Does Pale Moon have support for the rel="noopener" attribute?

Postby 0strodamus » Thu Feb 09, 2017 9:33 pm

As far as I can tell, Noscript 2.9.0.14 doesn't block this if you allow scripts on https://mathiasbynens.github.io and/or https://mathiasbynens.be. RequestPolicy also obviously isn't detecting the same-origin tab manipulation at all. Because other modern browsers are implementing changes to mitigate this, I filed an Issue and hopefully this is something Pale Moon can implement too.

This noopener_by_default userscript is working for me in Pale Moon as tested on https://mathiasbynens.github.io/rel-noopener/.
archlinux | OpenRC | TOMOYO Linux | Xfce

Nihil Verum Nisi Mors

User avatar
0strodamus
Moon lover
Moon lover
Posts: 83
Joined: Wed Nov 19, 2014 7:48 pm
Location: US

Re: Does Pale Moon have support for the rel="noopener" attribute?  Topic is solved

Postby 0strodamus » Fri Feb 10, 2017 12:13 am

According to Moonchild, Pale Moon does already have support for the rel="noopener" attribute.
archlinux | OpenRC | TOMOYO Linux | Xfce

Nihil Verum Nisi Mors

User avatar
half-moon
Astronaut
Astronaut
Posts: 898
Joined: Sun Jul 20, 2014 12:30 pm
Location: USA

Re: Does Pale Moon have support for the rel="noopener" attribute?

Postby half-moon » Fri Feb 10, 2017 12:20 am

ok, thanks man.

GreenGeek
Fanatic
Fanatic
Posts: 214
Joined: Sun Sep 11, 2016 4:36 pm

Re: Does Pale Moon have support for the rel="noopener" attribute?

Postby GreenGeek » Mon Apr 17, 2017 9:28 pm

OK, I've been reading quite a bit about this on several sites but mostly starting from ghacksuserjs on github. It seems to me (but I could be wrong) that we are talking about two different aspects of the issue. Pale Moon has support for rel=noopener but that has to be added to a link by the website author, correct? Whereas the point of an extension or script is to add it without depending on the webmaster who posts the link on his page. If I have this correct we still need a script or extension to take full advantage of the support for it that PM has by adding it to links the webmasters didn't.

User avatar
Moonchild
Pale Moon guru
Pale Moon guru
Posts: 19155
Joined: Sun Aug 28, 2011 5:27 pm
Location: 58.5°N 15.5°E
Contact:

Re: Does Pale Moon have support for the rel="noopener" attribute?

Postby Moonchild » Tue Apr 18, 2017 10:13 am

It is up to the webmasters to add this property to links if they do not want the linked site to have control over their page.
This is entirely to protect the webmaster's site (prevent opener navigation control) - nothing else.
Improving Mozilla code: You know you're on the right track with code changes when you spend the majority of your time deleting code.
Image

User avatar
0strodamus
Moon lover
Moon lover
Posts: 83
Joined: Wed Nov 19, 2014 7:48 pm
Location: US

Re: Does Pale Moon have support for the rel="noopener" attribute?

Postby 0strodamus » Wed Apr 19, 2017 2:53 am

GreenGeek wrote:If I have this correct we still need a script or extension to take full advantage of the support for it that PM has by adding it to links the webmasters didn't.

I would say yes and I have been using the Disable Targets userscript from legroom.net.
archlinux | OpenRC | TOMOYO Linux | Xfce

Nihil Verum Nisi Mors


Return to “Development (discussion)”

Who is online

Users browsing this forum: No registered users and 2 guests