Chromium Code Reviews
DescriptionMake window.showModalDialog disabled at runtime
We would like to remove showModalDialog
based on its low usage (as high as ~120 of every 1M
reported page views on week days and as low as ~60
of 1M reported page views on weekends) and extremely
high complexity (showModalDialog requires running a
nested event loop at a arbitrary point inside a
renderer which then allows display of arbitrary web
content and execution of arbitrary JavaScript
inside this nested context).
60 views per million is our historical removal threshold
so this is a higher risk removal, however the
unique complexity and regular reports of security
bugs has pushed for an accelerated removal.
Mozilla has also long-deprecated showModalDialog
and is also considering removal:
https://bugzilla.mozilla.org/show_bug.cgi?id=981796
Intent To Remove thread has much more info:
https://groups.google.com/a/chromium.org/d/msg/blink-dev/xh9fPX0ijqk/ixHZCOH6GLgJ
We removed showModalDialog from M35 Beta, but reverted
the changes before shipping. This removes showModalDialog
from M36 via a runtime flag which will allow us to
enable/disable with much lower risk as the feature
is still present in our testing configuration while
being diabled from our shipping configuration.
BUG=345831
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=171889
Patch Set 1 #
Messages
Total messages: 7 (0 generated)
|
||||||||||||||||||||||||||||