[PR #29417] Fix immediate window open defaults and error handling #32410

Closed
opened 2026-02-21 20:51:21 -05:00 by yindo · 0 comments
Owner

Original Pull Request: https://github.com/langgenius/dify/pull/29417

State: closed
Merged: Yes


Summary

  • Immediate window opens were not defaulting to noopener,noreferrer and left opener intact, leaving a tabnabbing vector for direct links; the branch also ignored popup failures.
  • Apply safe defaults (noopener,noreferrer), clear opener, and invoke onError when window.open returns null so async URL fetch is skipped after a blocked popup.
  • Async placeholder flow stays as-is; new tests cover the immediate-path opener clearing and blocked-window error reporting.

Testing

  • pnpm type-check:tsgo
  • pnpm test -- use-async-window-open.spec.ts
**Original Pull Request:** https://github.com/langgenius/dify/pull/29417 **State:** closed **Merged:** Yes --- ## Summary - Immediate window opens were not defaulting to `noopener,noreferrer` and left `opener` intact, leaving a tabnabbing vector for direct links; the branch also ignored popup failures. - Apply safe defaults (`noopener,noreferrer`), clear `opener`, and invoke `onError` when `window.open` returns `null` so async URL fetch is skipped after a blocked popup. - Async placeholder flow stays as-is; new tests cover the immediate-path opener clearing and blocked-window error reporting. ## Testing - pnpm type-check:tsgo - pnpm test -- use-async-window-open.spec.ts
yindo added the pull-request label 2026-02-21 20:51:21 -05:00
yindo closed this issue 2026-02-21 20:51:21 -05:00
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#32410