Enforcing no-opener for cross-top-level-site blob URL top-level navigations

[recvfrom]

Request for Mozilla Position on an Emerging Web Specification

• Specification title: Enforcing no-opener for cross-top-level-site blob URL top-level navigations
• Specification or proposal URL (if available): Enforce noopener on cross-top-level-site Blob URLs whatwg/html#10731
• Explainer URL (if available):
• Proposal author(s) (@-mention GitHub accounts): @recvfrom
• Caniuse.com URL (optional):
• Bugzilla URL (optional): https://bugzilla.mozilla.org/show_bug.cgi?id=1928383
• Mozillians who can provide input (optional): @artines1
• WebKit standards-position:

Other information

The proposal is to enforce noopener on top-level navigations to Blob URLs where the Blob URL site is cross-site to the top-level site of the document performing the navigation. Safari has already implemented a variation of this (using origins instead of sites), and @artines1 expressed support for this [1] as well. For Chromium, we are planning to implement this change and it was requested [2] that we get a formal Mozilla position on this change.

Note that we plan to implement this change in Chromium alongside partitioning of Blob URL usage by StorageKey, which aligns with what Mozilla has already implemented. We've landed corresponding spec changes for that as well [3][4].

For more information, see the corresponding blink-dev post [5].

[1] w3c/FileAPI#153 (comment)
[2] https://groups.google.com/a/chromium.org/g/blink-dev/c/erVBugcYwRc/m/G_-vcFM2AQAJ
[3] w3c/FileAPI#201 - Partition Blob URL revocation by Storage Key
[4] whatwg/fetch#1783 - Partition Blob URL fetches by Storage Key
[5] https://groups.google.com/a/chromium.org/g/blink-dev/c/erVBugcYwRc/m/ckCh2CkhBgAJ