Why does Firefox execute Javascript in the referring window's/tab's context when target="_blank" is used with a data:uri?
I set a link's target to _blank. With the href attribute set to a data-uri with a script tag, and the previous window's context executes the javascript. Does this happen with using window.open()? This would allow an attacker with XSS to steal localStorage data, and there is apparently no way for a developer to isolate a window's execution context. My question is, why does a data:uri execute script in the previous window's (i.e the window with the target="_blank" attribute set) context even though it opens in a new tab? And, how is a developer supposed to isolate a window's Javascript context, since _blank doesn't do it?
Chosen solution
JavaScript allows some access between windows (e.g., using the window.opener property from the "child" window).
What is the attack you want to guard against?
Read this answer in context 👍 0All Replies (3)
I don't use data URIs, so this may be a dumb question: is Firefox processing your data URI differently than the way it would execute the same code in an onclick handler in the same link?
I think it would be processing it the same way as onclick. The inconsistency here is, a _blank or a _new window implies a new context, but the Javascript runs in the same context that it came from. Is there a secure way to isolate the two windows? (one with the link, and one that just opened by clicking the link)
Chosen Solution
JavaScript allows some access between windows (e.g., using the window.opener property from the "child" window).
What is the attack you want to guard against?