Issue 3568 - Block pop-ups opened via an intermediate window

lib/child/contentPolicy.js

 /*
  * This file is part of Adblock Plus <https://adblockplus.org/>,
  * Copyright (C) 2006-2015 Eyeo GmbH
  *
  * Adblock Plus is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
  * published by the Free Software Foundation.
  *
  * Adblock Plus is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 290 matching lines @@
   },
 
   shouldProcess: function(contentType, contentLocation, requestOrigin, insecNode, mimeType, extra)
   {
     return Ci.nsIContentPolicy.ACCEPT;
   },
 
   //
   // nsIObserver interface implementation
   //
-  observe: function(subject, topic, data, uri, opener)
+  _openers: new WeakMap(),
+
+  observe: function(subject, topic, data, uri)
   {
     switch (topic)
     {
       case "content-document-global-created":
       {
-        if (!opener && subject instanceof Ci.nsIDOMWindow)
-          opener = subject.opener;
-        if (!opener)
-          return;
+        var opener = this._openers.get(subject);
+        if (!opener || Components.utils.isDeadWrapper(opener))
+        {
+          // We don't know the opener for this window yet, try to find it
+          if (subject instanceof Ci.nsIDOMWindow)
+            opener = subject.opener;
+
+          if (!opener)
+            return;
+
+          // The opener might be an intermediate window, get the real one
+          while (opener.location == "about:blank" && opener.opener)
+            opener = opener.opener;
+
+          this._openers.set(subject, opener);
+        }
 
         if (!uri && subject instanceof Ci.nsIDOMWindow)
           uri = subject.location.href;
         if (!shouldAllow(opener, opener.document, "POPUP", uri))
         {
           subject.stop();
           Utils.runAsync(() => subject.close());
         }
         else if (uri == "about:blank")
         {
           // An about:blank pop-up most likely means that a load will be
           // initiated asynchronously. Wait for that.
           Utils.runAsync(() =>
           {
             let channel = subject.QueryInterface(Ci.nsIInterfaceRequestor)
                                  .getInterface(Ci.nsIDocShell)
                                  .QueryInterface(Ci.nsIDocumentLoader)
                                  .documentChannel;
             if (channel)
-              this.observe(subject, topic, data, channel.URI.spec, opener);
+              this.observe(subject, topic, data, channel.URI.spec);
           });
         }
         break;
       }
     }
   },
 
   //
   // nsIChannelEventSink interface implementation
   //
@@ skipping 112 matching lines @@
         let property = (hasCols ? "cols" : "rows");
         let weights = parentNode[property].split(",");
         weights[index] = "0";
         parentNode[property] = weights.join(",");
       }
     }
     else
       node.classList.add(collapsedClass);
   }
 }