From 9964f1382fb9a8982289d7ef81ab5debed0cce52 Mon Sep 17 00:00:00 2001 From: Vykos Date: Thu, 4 Jun 2026 20:52:41 +0200 Subject: [PATCH] Isolate HTML popup openers (#2501) --- static/js/codeRunner.js | 1 + static/js/compare/index.js | 1 + tests/test_popup_opener_isolation_js.py | 37 +++++++++++++++++++++++++ 3 files changed, 39 insertions(+) create mode 100644 tests/test_popup_opener_isolation_js.py diff --git a/static/js/codeRunner.js b/static/js/codeRunner.js index 76b67f9..d0336b9 100644 --- a/static/js/codeRunner.js +++ b/static/js/codeRunner.js @@ -362,6 +362,7 @@ export function runHTML(code, panel) { addCloseBtn(panel); return; } + try { win.opener = null; } catch (_) {} win.document.open(); win.document.write(code); win.document.close(); diff --git a/static/js/compare/index.js b/static/js/compare/index.js index e6c00ae..f372078 100644 --- a/static/js/compare/index.js +++ b/static/js/compare/index.js @@ -1090,6 +1090,7 @@ function _exportPrint() { // the system print dialog — user can pick "Save as PDF" from there. const w = window.open('', '_blank'); if (!w) return; + try { w.opener = null; } catch (_) {} const escape = (s) => s.replace(/&/g, '&').replace(//g, '>'); const html = 'Compare export' + '