{"issue":{"user":{"id":1240282,"login":"jsamuel","url":"https://api.github.com/users/jsamuel","gravatar_id":"bc1d195cedb959a3946572b08ce9e7c7","avatar_url":"https://secure.gravatar.com/avatar/bc1d195cedb959a3946572b08ce9e7c7?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png"},"milestone":null,"created_at":"2011-12-22T02:35:39Z","title":"0.5.12 breaks tab opening keyword javascript bookmarklets in fx3.6","updated_at":"2011-12-22T02:35:41Z","labels":[{"name":"extension","url":"https://api.github.com/repos/RequestPolicy/tractest/labels/extension","color":"ededed"}],"state":"open","id":2632296,"pull_request":{"patch_url":null,"html_url":null,"diff_url":null},"html_url":"https://github.com/RequestPolicy/tractest/issues/72","closed_at":null,"number":72,"body":"Here is a example of such a bookmarklet, it performs a search in different engines in separate tabs\r\n{{{\r\njavascript:open('http://www.google.com/search?q=%s','_self');open('http://www.bing.com/search?q=%s');open('http://search.yahoo.com/search?p=%s');open('http://www.altavista.com/web/results?q=%s');open('http://www.ask.com/web?q=%s');\r\n}}}\r\n\r\nWhen RP is enabled, only the first url loads.  Verified on a new fx3.6 profile on xp32 with no other extensions.","url":"https://api.github.com/repos/RequestPolicy/tractest/issues/72","comments":1,"assignee":null},"comment":{"user":{"id":1240282,"login":"jsamuel","url":"https://api.github.com/users/jsamuel","gravatar_id":"bc1d195cedb959a3946572b08ce9e7c7","avatar_url":"https://secure.gravatar.com/avatar/bc1d195cedb959a3946572b08ce9e7c7?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png"},"created_at":"2011-12-22T02:35:41Z","updated_at":"2011-12-22T02:35:41Z","id":3242936,"body":"[justin] Thanks for reporting this. However, I don't think this can be fixed. I also don't believe this works with any version of Firefox that !RequestPolicy supports. I've tried just now with 0.5.8 and Firefox 3.0.17 and it always fails, but the way it fails can vary by which page one is on (sometimes blank tabs open, sometimes Firefox blocks them as popups -- I'm guessing the latter might be due to a page I tested on possibly having redefined the name \"open\").\r\n\r\nThe problem is that, as far as I know, the bookmarklet will execute like javascript on the current tab you're on. With the information that !RequestPolicy has access to when deciding when to allow requests (specifically, nsIContentPolicy::shouldLoad() and any other data !RequestPolicy has collected ahead of time), there's no distinction between the tabs opened by this bookmarklet and tabs opened by the same javascript if it existed in the page you're on.\r\n\r\nI think the way to solve this is to not try to perform this action through a bookmarklet and instead to use more privileged code to open these tabs. Basically, I think you'll need an extension. Maybe there's already an extension to provide this, possibly https://addons.mozilla.org/en-US/firefox/addon/1271, though I haven't looked too closely at that.\r\n\r\nAnyways, please let me know if you are aware of any workarounds for this. Otherwise, I'm inclined to say that because of the way bookmarklets work, there's no great solution to this. The only workaround I could think to try wasn't successful: I changed the bookmarklet to first change the current tab's location to some trusted domain that's harmless for requests in and out  and is fully whitelisted as both an origin and destination (what that would be depend on the person), and then had it call open(). However, the bookmarklet stops executing once the page changes, it seems.\r\n\r\nI do wish there was a way to solve this, because I imagine some people have a pretty strong need for bookmarklets that open() urls on other sites.\r\n\r\nMy final suggestion is to work around this by creating a page of your own that takes a request variable or information in the fragment of the uri and the javascript in that page opens the additional tabs. You'd need this page hosted somewhere as it wouldn't work to have it be a file:// uri. Let me know if you want to pursue that and need a hand with the code.","url":"https://api.github.com/repos/RequestPolicy/tractest/issues/comments/3242936"},"action":"created"}