Isolate HTML popup openers (#2501)

2026-06-04 20:52:41 +02:00
parent ca8ca38a32
commit 9964f1382f
3 changed files with 39 additions and 0 deletions
--- a/static/js/codeRunner.js
+++ b/static/js/codeRunner.js
@@ -362,6 +362,7 @@ export function runHTML(code, panel) {
    addCloseBtn(panel);
    return;
  }
+  try { win.opener = null; } catch (_) {}
  win.document.open();
  win.document.write(code);
  win.document.close();
--- a/static/js/compare/index.js
+++ b/static/js/compare/index.js
@@ -1090,6 +1090,7 @@ function _exportPrint() {
  // the system print dialog — user can pick "Save as PDF" from there.
  const w = window.open('', '_blank');
  if (!w) return;
+  try { w.opener = null; } catch (_) {}
  const escape = (s) => s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
  const html = '<!doctype html><meta charset="utf-8"><title>Compare export</title>' +
    '<style>body{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,sans-serif;max-width:780px;margin:32px auto;padding:0 24px;line-height:1.55;color:#222}' +