RequestPolicy/requestpolicy — Issue #204: users should not be able to allow redirects to javascript URIs
Author: jsamuel
Created: 2011-12-22 18:59:54+00:00
State: open
Labels: extension

imported trac ticket
created: 2011-03-04 11:17:43
reporter: justin

!RequestPolicy will show a redirect notification to users when redirects to javascript URIs are attempted. They can be attempted either through headers or meta refresh tags. Normally the browser will ignore redirects to javascript because it presents a security risk (see [https://www.mozilla.org/security/announce/2009/mfsa2009-22.html MFSA 2009-22]). With RP installed, the redirect will not happen automatically but instead of just ignoring the redirect, RP will show the user a redirect notification asking if they'd like to allow or deny the redirect. This opens up the possibility of a user either not understanding the risk or unintentionally allowing the redirect, in which case RP initiates the load of the javascript URI (a load that otherwise would have been completely ignored and the user would never have had the opportunity to allow it).

Phil Purviance reported this bug. I've added details about what's happening from the RP side as well as why the current RP behavior is bad.