Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Don't allow the javascript: protocol in navigation.navigate() #11533

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Don't allow the javascript: protocol in navigation.navigate() #11533

wants to merge 1 commit into from

Conversation

evilpie
Copy link
Member

@evilpie evilpie commented Aug 5, 2025 •
edited by pr-preview bot
Loading

navigation.navigate("javascript:alert(1)") is a new script execution sink that was newly added. We believe that it would be more useful for new APIs to not support the legacy javascript: protocol, compared to just keeping it because other APIs like location.href support it.

Fixes #11500

  • At least two implementers are interested (and none opposed):
    • Gecko
    • Webkit
  • Tests are written and can be reviewed and commented upon at:
    • …
  • Implementation bugs are filed:
    • Chromium: …
    • Gecko: https://bugzilla.mozilla.org/show_bug.cgi?id=1981104
    • WebKit: …
    • Deno (only for timers, structured clone, base64 utils, channel messaging, module resolution, web workers, and web storage): …
    • Node.js (only for timers, structured clone, base64 utils, channel messaging, and module resolution): …
  • Corresponding HTML AAM & ARIA in HTML issues & PRs:
  • MDN issue is filed: …
  • The top of this comment includes a clear commit message to use.

(See WHATWG Working Mode: Changes for more details.)

/nav-history-apis.html ( diff )

@annevk
Copy link
Member

annevk commented Aug 5, 2025

I discussed this with colleagues and while we don't really see any benefits to this, you can consider WebKit supportive as generally new APIs shouldn't spread badness.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
normative change topic: navigation
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Don't allow the javascript: protocol in navigation.navigate()
2 participants
@evilpie @annevk