Backends: GLFW, SDL2: Emscripten's OpenURL() passes 'noopener' to window.open(). (#9615, #7660, #7851)

The new tab opened by window.open(url, '_blank') keeps a reference to our page (window.opener). With a
"javascript:" url, the script runs in a blank page of the same origin, with full access to ours: a document
rendered with TextLinkOpenURL() could carry such a link. 'noopener' removes that reference.
This commit is contained in:
Pascal Thomet 2026-11-09 13:30:01 +01:00 committed by ocornut
parent 3aae2df9f6
commit 5554e8e476
3 changed files with 6 additions and 2 deletions

View File

@ -663,7 +663,7 @@ void ImGui_ImplGlfw_SetCallbacksChainForAllWindows(bool chain_for_all_windows)
#if EMSCRIPTEN_USE_PORT_CONTRIB_GLFW3 >= 34020240817
void ImGui_ImplGlfw_EmscriptenOpenURL(const char* url) { if (url) emscripten::glfw3::OpenURL(url); }
#else
EM_JS(void, ImGui_ImplGlfw_EmscriptenOpenURL, (const char* url), { url = url ? UTF8ToString(url) : null; if (url) window.open(url, '_blank'); });
EM_JS(void, ImGui_ImplGlfw_EmscriptenOpenURL, (const char* url), { url = url ? UTF8ToString(url) : null; if (url) window.open(url, '_blank', 'noopener'); });
#endif
#endif

View File

@ -507,7 +507,7 @@ bool ImGui_ImplSDL2_ProcessEvent(const SDL_Event* event)
}
#ifdef __EMSCRIPTEN__
EM_JS(void, ImGui_ImplSDL2_EmscriptenOpenURL, (char const* url), { url = url ? UTF8ToString(url) : null; if (url) window.open(url, '_blank'); });
EM_JS(void, ImGui_ImplSDL2_EmscriptenOpenURL, (char const* url), { url = url ? UTF8ToString(url) : null; if (url) window.open(url, '_blank', 'noopener'); });
#endif
static bool ImGui_ImplSDL2_Init(SDL_Window* window, SDL_Renderer* renderer, void* sdl_gl_context)

View File

@ -112,6 +112,10 @@ Other Changes:
to reflect that they can also build X64 or ARM64, given the right environment.
Made the script detect the environment when needed (e.g. to specify library path).
- Examples: added support for ARM64 in selected build_win.bat helpers. (#9593) [@Harishmcw]
- Backends:
- GLFW, SDL2: Emscripten implementation of `Platform_OpenInShellFn` calls
`window.open()` with `noopener`: prevents newly opened tab from keeping a
reference to opening page. (#9615, #7660, #7851) [@pthom]
-----------------------------------------------------------------------