0

From an HTML/JavaScript perspective I'm currently aware of 2 methods to spawn a new browser tab (or window).

  1. An HTML form <form> or anchor <a> with a target attribute e.g. target="_blank"
  2. A JavaScript call to window.open(url, name, features);

Note: I'm intentionally ignoring the IE-only showModalDialog & showModelessDialog methods.

However I recently encountered a very buggy scenario where I was able to spawn multiple tabs (actually endless) without clicking a link, submitting a form, or calling window.open() in Internet Explorer ONLY just by loading a page.

Since this bug was causing a terrible user experience (essentially browser lockup) I quickly mitigated the issue by blocking direct access to this screen - but I'm baffled as to how the other tabs could even spawn (regardless of the actual bug) if none of the options mentioned above were triggered.

Sadly the screen in question involves some SSO/security related login code so I can't post the details here but I'd love to know if there are any other ways to spawn new tabs that I might have overlooked so that I can dig into the code to see if there is a resolution.

e.g. Are there any HTTP Headers that might trigger a new tab?

scunliffe
  • 62,582
  • 25
  • 126
  • 161
  • Traditionally, such behavior is generally a sign of malware/infection. I would certainly investigate that possibility. You didn't mention which version of IE (or Windows) you're working with or if you see this behavior on public pages, on Intranet zone, or even in different browsers. I'm not personally aware of any HTTP headers that would trigger this behavior, but I have seen cases where add-ons such as Flash, Java, and others have been abused to open new windows. One way to troubleshoot this possibility is to use Manage Add-ons to selectively enable/disable individual add-ons. – Lance Leonard Feb 17 '15 at 21:21
  • I'm fairly confident this wasn't a virus (and the page was the same page from my server, not an ad/search engine). It occurred on all IE browsers tested (either IE9 or IE10). Based on a comment from @ericlaw I'm beginning to believe that he's right and that I may have hit a zone-crossing bug in LoRIE/LCIE. – scunliffe Feb 18 '15 at 01:06

0 Answers0