search

danielstjules / blankshield

Prevent reverse tabnabbing phishing attacks caused by _blank
http://danielstjules.github.io/blankshield/
MIT License
140 stars 24 forks source link

URL not getting opened in new tab #15

Open aswiinraviprakash opened 5 years ago

aswiinraviprakash commented 5 years ago

When using blankshield to open a url in new Tab, the url is being blocked in chrome browser. It works fine in all other browser.

Manours commented 5 years ago

I've got the same problem since Chrome 72. Maybe because of that : https://www.chromestatus.com/feature/5989473649164288

budley commented 5 years ago

Same here - the library seems to be included in a WordPress security plugin called iThemes Security and so is breaking lots of sites via that (well, Chrome's change is - not the author's fault). If it can't be fixed could you let us know please then I can maybe let iThemes know so they can pull that feature (that many people might not be aware is causing their sites problems!). Thanks.

TimothyBJacobs commented 5 years ago

@budley We're pushing a fix to add the noopener rel to links instead of using blankshield for browsers that support the noopener property.

meeq commented 5 years ago

https://bugs.chromium.org/p/chromium/issues/detail?id=844455

https://html.spec.whatwg.org/#apis-for-creating-and-navigating-browsing-contexts-by-name

The window open steps, given a string url, a string target, and a string features, are as follows:

  1. If the event loop's termination nesting level is nonzero, return null.

I assume this is happening because the iframe is removed immediately after it's added, which Chrome now considers a pop-up during unload: https://github.com/danielstjules/blankshield/blob/6e208bf25a44bf50d1a5e85ae96fee0c015d05bc/blankshield.js#L187-L190

Edit: Even if L190 is removed, the pop-up blocker is still triggered.