Bug 1116977 - Disallow link clicks during beforeunload. r=smaug, a=lmandel
authorGijs Kruitbosch <gijskruitbosch@gmail.com>
Fri, 23 Jan 2015 15:35:10 +0000
changeset 249429 127079a6ab72873602d27efeac27364fa23c8ab1
parent 249428 94ecdce1683145026c73ec586b15e04235cfce0f
child 249430 d2b8bc669b1073376d322e3c985c83a4513649ad
push id4489
push userraliiev@mozilla.com
push dateMon, 23 Feb 2015 15:17:55 +0000
treeherdermozilla-beta@fd7c3dc24146 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerssmaug, lmandel
bugs1116977
milestone37.0a2
Bug 1116977 - Disallow link clicks during beforeunload. r=smaug, a=lmandel
docshell/base/nsDocShell.cpp
docshell/test/browser/browser_onbeforeunload_navigation.js
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -13149,17 +13149,17 @@ nsDocShell::OnLinkClick(nsIContent* aCon
                         const char16_t* aTargetSpec,
                         const nsAString& aFileName,
                         nsIInputStream* aPostDataStream,
                         nsIInputStream* aHeadersDataStream,
                         bool aIsTrusted)
 {
   NS_ASSERTION(NS_IsMainThread(), "wrong thread");
 
-  if (!IsOKToLoadURI(aURI)) {
+  if (!IsNavigationAllowed() || !IsOKToLoadURI(aURI)) {
     return NS_OK;
   }
 
   // On history navigation through Back/Forward buttons, don't execute
   // automatic JavaScript redirection such as |anchorElement.click()| or
   // |formElement.submit()|.
   //
   // XXX |formElement.submit()| bypasses this checkpoint because it calls
@@ -13205,17 +13205,17 @@ nsDocShell::OnLinkClickSync(nsIContent *
   // Initialize the DocShell / Request
   if (aDocShell) {
     *aDocShell = nullptr;
   }
   if (aRequest) {
     *aRequest = nullptr;
   }
 
-  if (!IsOKToLoadURI(aURI)) {
+  if (!IsNavigationAllowed() || !IsOKToLoadURI(aURI)) {
     return NS_OK;
   }
 
   // XXX When the linking node was HTMLFormElement, it is synchronous event.
   //     That is, the caller of this method is not |OnLinkClickEvent::Run()|
   //     but |HTMLFormElement::SubmitSubmission(...)|.
   if (nsGkAtoms::form == aContent->Tag() && ShouldBlockLoadingForBackButton()) {
     return NS_OK;
--- a/docshell/test/browser/browser_onbeforeunload_navigation.js
+++ b/docshell/test/browser/browser_onbeforeunload_navigation.js
@@ -108,16 +108,39 @@ var testFns = [
   function(e) {
     e.target.location.reload();
     return "stop";
   },
   function(e) {
     e.target.location.replace('otherpage-location-replaced.html');
     return "stop";
   },
+  function(e) {
+    var link = e.target.createElement('a');
+    link.href = "otherpage.html";
+    e.target.body.appendChild(link);
+    link.click();
+    return "stop";
+  },
+  function(e) {
+    var link = e.target.createElement('a');
+    link.href = "otherpage.html";
+    link.setAttribute("target", "_blank");
+    e.target.body.appendChild(link);
+    link.click();
+    return "stop";
+  },
+  function(e) {
+    var link = e.target.createElement('a');
+    link.href = e.target.location.href;
+    e.target.body.appendChild(link);
+    link.setAttribute("target", "somearbitrarywindow");
+    link.click();
+    return "stop";
+  },
 ];
 
 function runNextTest() {
   currentTest++;
   if (currentTest >= testFns.length) {
     if (!stayingOnPage) {
       finish();
       return;