Don't allow the javascript: protocol in navigation.navigate() #11533
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Member
|
I discussed this with colleagues and while we don't really see any benefits to this, you can consider WebKit supportive as generally new APIs shouldn't spread badness. |
domenic
approved these changes
Aug 19, 2025
Member
domenic
left a comment
domenic
left a comment
There was a problem hiding this comment.
LGTM once the PR template is filled out.
Member
Author
|
Thanks. I completed the PR template. |
basuke
added a commit
to basuke/WebKit
that referenced
this pull request
Aug 27, 2025
…vigate() https://bugs.webkit.org/show_bug.cgi?id=297650 rdar://158867866 Reviewed by NOBODY (OOPS!). navigation.navigate("javascript:alert(1)") is a new script execution sink that was newly added. We believe that it would be more useful for new APIs to not support the legacy javascript: protocol, compared to just keeping it because other APIs like location.href support it. whatwg/html#11533 * LayoutTests/http/wpt/navigation-api/navigation-methods/return-value/navigate-javascript-url-expected.txt: Added. * LayoutTests/http/wpt/navigation-api/navigation-methods/return-value/navigate-javascript-url.html: Added. * LayoutTests/http/wpt/navigation-api/navigation-methods/return-value/resources/helpers.js: Added. (window.assertReturnValue): (window.assertNeverSettles): (window.assertBothFulfillEntryNotAvailable.async t): (window.assertBothFulfill.async t): (window.assertCommittedFulfillsFinishedRejectsExactly.async t): (window.assertCommittedFulfillsFinishedRejectsDOM.async t): (window.waitForAllLenient): (window.assertBothRejectExactly.async t): (window.assertBothRejectDOM.async t): * Source/WebCore/page/Navigation.cpp: (WebCore::Navigation::navigate):
webkit-commit-queue
pushed a commit
to basuke/WebKit
that referenced
this pull request
Aug 28, 2025
…vigate() https://bugs.webkit.org/show_bug.cgi?id=297650 rdar://158867866 Reviewed by Tim Nguyen. navigation.navigate("javascript:alert(1)") is a new script execution sink that was newly added. We believe that it would be more useful for new APIs to not support the legacy javascript: protocol, compared to just keeping it because other APIs like location.href support it. whatwg/html#11533 * LayoutTests/http/wpt/navigation-api/navigation-methods/return-value/navigate-javascript-url-expected.txt: Added. * LayoutTests/http/wpt/navigation-api/navigation-methods/return-value/navigate-javascript-url.html: Added. * LayoutTests/http/wpt/navigation-api/navigation-methods/return-value/resources/helpers.js: Added. (window.assertReturnValue): (window.assertNeverSettles): (window.assertBothFulfillEntryNotAvailable.async t): (window.assertBothFulfill.async t): (window.assertCommittedFulfillsFinishedRejectsExactly.async t): (window.assertCommittedFulfillsFinishedRejectsDOM.async t): (window.waitForAllLenient): (window.assertBothRejectExactly.async t): (window.assertBothRejectDOM.async t): * Source/WebCore/page/Navigation.cpp: (WebCore::Navigation::navigate): Canonical link: https://commits.webkit.org/299235@main
Jarred-Sumner
pushed a commit
to oven-sh/WebKit
that referenced
this pull request
Aug 29, 2025
…vigate() https://bugs.webkit.org/show_bug.cgi?id=297650 rdar://158867866 Reviewed by Tim Nguyen. navigation.navigate("javascript:alert(1)") is a new script execution sink that was newly added. We believe that it would be more useful for new APIs to not support the legacy javascript: protocol, compared to just keeping it because other APIs like location.href support it. whatwg/html#11533 * LayoutTests/http/wpt/navigation-api/navigation-methods/return-value/navigate-javascript-url-expected.txt: Added. * LayoutTests/http/wpt/navigation-api/navigation-methods/return-value/navigate-javascript-url.html: Added. * LayoutTests/http/wpt/navigation-api/navigation-methods/return-value/resources/helpers.js: Added. (window.assertReturnValue): (window.assertNeverSettles): (window.assertBothFulfillEntryNotAvailable.async t): (window.assertBothFulfill.async t): (window.assertCommittedFulfillsFinishedRejectsExactly.async t): (window.assertCommittedFulfillsFinishedRejectsDOM.async t): (window.waitForAllLenient): (window.assertBothRejectExactly.async t): (window.assertBothRejectDOM.async t): * Source/WebCore/page/Navigation.cpp: (WebCore::Navigation::navigate): Canonical link: https://commits.webkit.org/299235@main
zcorpan
pushed a commit
to web-platform-tests/wpt
that referenced
this pull request
Sep 17, 2025
lando-prod-mozilla bot
pushed a commit
to mozilla-firefox/firefox
that referenced
this pull request
Sep 22, 2025
…navigation.navigate(), a=testonly Automatic update from web-platform-tests Don't allow the javascript: protocol in navigation.navigate() See whatwg/html#11533 -- wpt-commits: 8da7ccbffe21ee27d5fc7660e391c8fde7cad730 wpt-pr: 54544
i3roly
pushed a commit
to i3roly/firefox-dynasty
that referenced
this pull request
Sep 24, 2025
…navigation.navigate(), a=testonly Automatic update from web-platform-tests Don't allow the javascript: protocol in navigation.navigate() See whatwg/html#11533 -- wpt-commits: 8da7ccbffe21ee27d5fc7660e391c8fde7cad730 wpt-pr: 54544
mertcanaltin
pushed a commit
to mertcanaltin/wpt
that referenced
this pull request
Oct 26, 2025
This was referenced Nov 12, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
navigation.navigate("javascript:alert(1)")is a new script execution sink that was newly added. We believe that it would be more useful for new APIs to not support the legacy javascript: protocol, compared to just keeping it because other APIs likelocation.hrefsupport it.Fixes #11500
(See WHATWG Working Mode: Changes for more details.)
/nav-history-apis.html ( diff )