wiki: clear window.opener [solved: see top of OP]

Edit

• Legacy GM & script: no issues
• Web Extensions & Script: disable it and use window.opener be gone
  • this is the same script but injected by an extension to solve the issues

---

OP as follows

issue to deal with clear window.opener. quick wiki link quick test link

note:

• when I say 57+ I am using that as the marker since that is based on our extensions recommendations (we recommend VM in 57+) and is a clean line in the sand and legacy extensions vs web ext. Tests were only done on 59.0.2 (VM is 2.9.1)

summary:

• all three scripts work in legacy GM and ESR52.x which we still support
• in web ext GM and 57+, all three scripts fail (due to document-start?)
• in web ext VM and 57+, only clear window.opener “fails”
  • earthlng tested webext GM (correct me if wrong)
• the script noopener_by_default in VM and 57+ works
• edit: diff in the two scripts: noopener_by_default is heavy handed and modifies the original/source page, while clear window.opener modifies the new pages
• edit: diffs in how web extensions GM+VM handle document-start
• edit: GM almost has a document start fix in place (different to VM)

conclusion:

• clear window.opener if modified might work in VM (see the new script), but see diffs in what the script actually does.

done:

• wiki: I have already edited the top few lines of the wiki to clearly say that the scripts will not work with the web ext version of GM.

to do:

• decide if earthlng wishes to provide a second script for 57+
• clearly label the current script as legacy extension only
• otherwise point to the new script OR point to an extension
• wait for GM to land the document-start fix and switch to GM
• talk to VM and see what can be done

Awaiting earthlng’s decision, insight, knowledge

[earthlng]

Probably.

https://anonfile.com/ef3fm5eab4/windowopener_be_gone-1.0-an_fx.xpi

Very basic webextension that injects the user-script listed in the wiki. No whitelist support or anything like that. Not listed on AMO because I don’t want to deal with people asking for new features or bitching about how it breaks some sites. It is what it is, take it or leave it. I might improve it when I move away from ESR but hopefully until then GM will be able to correctly run scripts like this again. The extension also works on ESR52 but it’s probably more convenient to use the user-script with legacy GM for an easy way to exclude certain sites.

@crssi it’s only my opinion but yes I think it’s possible that an attacker can abuse window.opener on same-domain as well.

[rusty-snake]

FYI: A hardened TC can be a replacement for window.opener be gone.