Return null from native window.open when allowpopups is unset

atom/browser/atom_browser_client.cc

@@ -147,6 +147,12 @@ bool AtomBrowserClient::RendererUsesNativeWindowOpen(int process_id) {
   return it != process_preferences_.end() && it->second.native_window_open;
 }
 
+bool AtomBrowserClient::RendererDisablesPopups(int process_id) {
+  base::AutoLock auto_lock(process_preferences_lock_);
+  auto it = process_preferences_.find(process_id);
+  return it != process_preferences_.end() && it->second.disable_popups;
+}
+
 void AtomBrowserClient::RenderProcessWillLaunch(
     content::RenderProcessHost* host) {
   int process_id = host->GetID();
@@ -160,6 +166,8 @@ void AtomBrowserClient::RenderProcessWillLaunch(
   process_prefs.sandbox = WebContentsPreferences::IsSandboxed(web_contents);
   process_prefs.native_window_open
       = WebContentsPreferences::UsesNativeWindowOpen(web_contents);
+  process_prefs.disable_popups
+      = WebContentsPreferences::DisablePopups(web_contents);
   AddProcessPreferences(host->GetID(), process_prefs);
   // ensure the ProcessPreferences is removed later
   host->AddObserver(this);
@@ -341,12 +349,22 @@ bool AtomBrowserClient::CanCreateWindow(
     bool* no_javascript_access) {
   DCHECK_CURRENTLY_ON(content::BrowserThread::IO);
 
-  if (IsRendererSandboxed(opener_render_process_id)
+  if (IsRendererSandboxed(opener_render_process_id)) {
-      || RendererUsesNativeWindowOpen(opener_render_process_id)) {
     *no_javascript_access = false;
     return true;
   }
 
+  if (RendererUsesNativeWindowOpen(opener_render_process_id)) {
+    if (RendererDisablesPopups(opener_render_process_id)) {
+      // <webview> without allowpopups attribute should return
+      // null from window.open calls
+      return false;
+    } else {
+      *no_javascript_access = false;
+      return true;
+    }
+  }
+
   if (delegate_) {
     content::BrowserThread::PostTask(content::BrowserThread::UI, FROM_HERE,
         base::Bind(&api::App::OnCreateWindow,

atom/browser/atom_browser_client.h

@@ -122,11 +122,13 @@ class AtomBrowserClient : public brightray::BrowserClient,
   struct ProcessPreferences {
     bool sandbox;
     bool native_window_open;
+    bool disable_popups;
   };
   void AddProcessPreferences(int process_id, ProcessPreferences prefs);
   void RemoveProcessPreferences(int process_id);
   bool IsRendererSandboxed(int process_id);
   bool RendererUsesNativeWindowOpen(int process_id);
+  bool RendererDisablesPopups(int process_id);
 
   // pending_render_process => current_render_process.
   std::map<int, int> pending_processes_;

atom/browser/web_contents_preferences.cc

@@ -237,6 +237,11 @@ bool WebContentsPreferences::IsPluginsEnabled(
   return IsPreferenceEnabled("plugins", web_contents);
 }
 
+bool WebContentsPreferences::DisablePopups(
+    content::WebContents* web_contents) {
+  return IsPreferenceEnabled("disablePopups", web_contents);
+}
+
 // static
 void WebContentsPreferences::OverrideWebkitPrefs(
     content::WebContents* web_contents, content::WebPreferences* prefs) {

atom/browser/web_contents_preferences.h

@@ -41,6 +41,7 @@ class WebContentsPreferences
                                   content::WebContents* web_contents);
   static bool IsSandboxed(content::WebContents* web_contents);
   static bool UsesNativeWindowOpen(content::WebContents* web_contents);
+  static bool DisablePopups(content::WebContents* web_contents);
   static bool IsPluginsEnabled(content::WebContents* web_contents);
 
   // Modify the WebPreferences according to |web_contents|'s preferences.

lib/browser/guest-view-manager.js

@@ -225,6 +225,10 @@ const attachGuest = function (event, elementInstanceId, guestInstanceId, params)
     webPreferences.preloadURL = params.preload
   }
 
+  if (webPreferences.nativeWindowOpen === true && !params.allowpopups) {
+    webPreferences.disablePopups = true
+  }
+
   embedder.emit('will-attach-webview', event, webPreferences, params)
   if (event.defaultPrevented) {
     if (guest.viewInstanceId == null) guest.viewInstanceId = params.instanceId