Issue 3568 - Block pop-ups opened via an intermediate window

lib/child/contentPolicy.js

Index: lib/child/contentPolicy.js
===================================================================
--- a/lib/child/contentPolicy.js
+++ b/lib/child/contentPolicy.js
@@ -303,26 +303,40 @@ var PolicyImplementation =
   shouldProcess: function(contentType, contentLocation, requestOrigin, insecNode, mimeType, extra)
   {
     return Ci.nsIContentPolicy.ACCEPT;
   },
 
   //
   // nsIObserver interface implementation
   //
-  observe: function(subject, topic, data, uri, opener)
+  _openers: new WeakMap(),
+
+  observe: function(subject, topic, data, uri)
   {
     switch (topic)
     {
       case "content-document-global-created":
       {
-        if (!opener && subject instanceof Ci.nsIDOMWindow)
-          opener = subject.opener;
-        if (!opener)
-          return;
+        var opener = this._openers.get(subject);
+        if (!opener || Components.utils.isDeadWrapper(opener))
+        {
+          // We don't know the opener for this window yet, try to find it
+          if (subject instanceof Ci.nsIDOMWindow)
+            opener = subject.opener;
+
+          if (!opener)
+            return;
+
+          // The opener might be an intermediate window, get the real one
+          while (opener.location == "about:blank" && opener.opener)
+            opener = opener.opener;
+
+          this._openers.set(subject, opener);
+        }
 
         if (!uri && subject instanceof Ci.nsIDOMWindow)
           uri = subject.location.href;
         if (!shouldAllow(opener, opener.document, "POPUP", uri))
         {
           subject.stop();
           Utils.runAsync(() => subject.close());
         }
@@ -332,17 +346,17 @@ var PolicyImplementation =
           // initiated asynchronously. Wait for that.
           Utils.runAsync(() =>
           {
             let channel = subject.QueryInterface(Ci.nsIInterfaceRequestor)
                                  .getInterface(Ci.nsIDocShell)
                                  .QueryInterface(Ci.nsIDocumentLoader)
                                  .documentChannel;
             if (channel)
-              this.observe(subject, topic, data, channel.URI.spec, opener);
+              this.observe(subject, topic, data, channel.URI.spec);
           });
         }
         break;
       }
     }
   },
 
   //