bradtriebwasser / fullscreen-popup Goto Github PK

Although "fullscreen" was removed from browser permission content setting, however, it is possible to not allow new window open in fullscreen by Permission Policy, such as header Permission-Policy: fullscreen=(). It would be an annoyance issue.

I only see the feature is gated behind "window-placement", but not "fullscreen" permission, should we provide an additional cases , giving a notice and escaping fullscreen mode?

Historically speaking, Internet Explorer 6 already supported a fullscreen=yes feature allowing window.open() to open a new window in fullscreen on the current screen. This was removed in later versions to prevent security problems where a malicious website could mimic another website, application or the operating system.

This features essentially brings this issue back - although partly mitigated using the fullscreen bubble and using a fullscreen window transition.

One possible security consideration that could be added is to prevent opening fullscreen windows on the same display as the user activation is happening. That makes this feature only usable for opening a window fullscreen on a different display. This may make it less interesting to use as an attack vector.

A website (which the user had granted window-management), could put untrusted data into a window.open call like below:

window.open(untrustedInputString,"_blank","popup,fullscreen")

While there are existing protections (window-management permission, exit bubbles), it may improve security by preventing cross-origin fullscreen popups altogether.

One additional use case is Point of Sale systems where there are two displays. One display is facing the operator and running the cash register software and one facing the customer. The customer facing display would typically show the receipt and total amount due.