Is setting target="_blank" links without a rel attribute to default as rel="noopener" now needed in Pale Moon?

Talk about code development, features, specific bugs, enhancements, patches, and similar things.
Forum rules
Please keep everything here strictly on-topic.
This board is meant for Pale Moon source code development related subjects only like code snippets, patches, specific bugs, git, the repositories, etc.

This is not for tech support! Please do not post tech support questions in the "Development" board!
Please make sure not to use this board for support questions. Please post issues with specific websites, extensions, etc. in the relevant boards for those topics.

Please keep things on-topic as this forum will be used for reference for Pale Moon development. Expect topics that aren't relevant as such to be moved or deleted.
Pause
Apollo supporter
Apollo supporter
Posts: 41
Joined: 2021-08-19, 10:05

Is setting target="_blank" links without a rel attribute to default as rel="noopener" now needed in Pale Moon?

Unread post by Pause » 2021-12-14, 23:53

Moonchild wrote:It is up to the webmasters to add this property to links if they do not want the linked site to have control over their page.
This is entirely to protect the webmaster's site (prevent opener navigation control) - nothing else.
That was said in this post in 2017, but a 2021 update on a page that tests whether taking control works with links without the rel attribute (https://mathiasbynens.github.io/rel-noopener/), which it currently does on Pale Moon unless you're using one of the userscripts mentioned elsewhere on this forum, it states that a spec change (with a link to this GitHub issue) has meant browsers now set it by default for any target="_blank" links that have no rel= attribute.

So does the spec change mean it will likely need to be applied to Pale Moon too (rather than solely relying on the webmasters) now that this behaviour is expected?

User avatar
Moonchild
Pale Moon guru
Pale Moon guru
Posts: 35478
Joined: 2011-08-28, 17:27
Location: Motala, SE
Contact:

Re: Is setting target="_blank" links without a rel attribute to default as rel="noopener" now needed in Pale Moon?

Unread post by Moonchild » 2021-12-15, 00:32

I find this to be very risky. You'd be explicitly breaking browsing context if you do that which i think bears a pretty big risk of breaking intra-site navigation that might use target=_blank to open a related page in a new tab or window.
"Sometimes, the best way to get what you want is to be a good person." -- Louis Rossmann
"Seek wisdom, not knowledge. Knowledge is of the past; wisdom is of the future." -- Native American proverb
"Linux makes everything difficult." -- Lyceus Anubite

Locked