From 5554e8e4768b367003cb97b23c11e16063e86a32 Mon Sep 17 00:00:00 2001 From: Pascal Thomet Date: Mon, 9 Nov 2026 13:30:01 +0100 Subject: [PATCH] Backends: GLFW, SDL2: Emscripten's OpenURL() passes 'noopener' to window.open(). (#9615, #7660, #7851) The new tab opened by window.open(url, '_blank') keeps a reference to our page (window.opener). With a "javascript:" url, the script runs in a blank page of the same origin, with full access to ours: a document rendered with TextLinkOpenURL() could carry such a link. 'noopener' removes that reference. --- backends/imgui_impl_glfw.cpp | 2 +- backends/imgui_impl_sdl2.cpp | 2 +- docs/CHANGELOG.txt | 4 ++++ 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/backends/imgui_impl_glfw.cpp b/backends/imgui_impl_glfw.cpp index 678129a07..2be125300 100644 --- a/backends/imgui_impl_glfw.cpp +++ b/backends/imgui_impl_glfw.cpp @@ -663,7 +663,7 @@ void ImGui_ImplGlfw_SetCallbacksChainForAllWindows(bool chain_for_all_windows) #if EMSCRIPTEN_USE_PORT_CONTRIB_GLFW3 >= 34020240817 void ImGui_ImplGlfw_EmscriptenOpenURL(const char* url) { if (url) emscripten::glfw3::OpenURL(url); } #else -EM_JS(void, ImGui_ImplGlfw_EmscriptenOpenURL, (const char* url), { url = url ? UTF8ToString(url) : null; if (url) window.open(url, '_blank'); }); +EM_JS(void, ImGui_ImplGlfw_EmscriptenOpenURL, (const char* url), { url = url ? UTF8ToString(url) : null; if (url) window.open(url, '_blank', 'noopener'); }); #endif #endif diff --git a/backends/imgui_impl_sdl2.cpp b/backends/imgui_impl_sdl2.cpp index a93bcc29e..d5ba4dade 100644 --- a/backends/imgui_impl_sdl2.cpp +++ b/backends/imgui_impl_sdl2.cpp @@ -507,7 +507,7 @@ bool ImGui_ImplSDL2_ProcessEvent(const SDL_Event* event) } #ifdef __EMSCRIPTEN__ -EM_JS(void, ImGui_ImplSDL2_EmscriptenOpenURL, (char const* url), { url = url ? UTF8ToString(url) : null; if (url) window.open(url, '_blank'); }); +EM_JS(void, ImGui_ImplSDL2_EmscriptenOpenURL, (char const* url), { url = url ? UTF8ToString(url) : null; if (url) window.open(url, '_blank', 'noopener'); }); #endif static bool ImGui_ImplSDL2_Init(SDL_Window* window, SDL_Renderer* renderer, void* sdl_gl_context) diff --git a/docs/CHANGELOG.txt b/docs/CHANGELOG.txt index f54edf32c..f310858aa 100644 --- a/docs/CHANGELOG.txt +++ b/docs/CHANGELOG.txt @@ -112,6 +112,10 @@ Other Changes: to reflect that they can also build X64 or ARM64, given the right environment. Made the script detect the environment when needed (e.g. to specify library path). - Examples: added support for ARM64 in selected build_win.bat helpers. (#9593) [@Harishmcw] +- Backends: + - GLFW, SDL2: Emscripten implementation of `Platform_OpenInShellFn` calls + `window.open()` with `noopener`: prevents newly opened tab from keeping a + reference to opening page. (#9615, #7660, #7851) [@pthom] -----------------------------------------------------------------------