[Webkit-unassigned] [Bug 26989] Unsafe cross domain javascript redirect

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=26989


Adam Barth <abarth at webkit.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         OS/Version|Windows XP                  |All
           Platform|PC                          |All




--- Comment #3 from Adam Barth <abarth at webkit.org>  2009-09-22 23:09:29 PDT ---
It sounds like the opener restriction is preventing the navigation (because
example2.com is not the opener of example1.com).  In general, it's hard to
state a threat model in which the opener restriction buys you much security.

It seems fine to allow this case, especially if that makes us more compatible
with Firefox 3.5.  It seems similar to allowing frame-busting (just popups
instead of iframes).

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.