Bug 241432 - execCommand('undo') allows to restore closed tabs from HTML
Summary: execCommand('undo') allows to restore closed tabs from HTML
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: HTML Editing (show other bugs)
Version: Safari 15
Hardware: Mac (Apple Silicon) macOS 10.15
: P2 Normal
Assignee: Nobody
URL: https://jsfiddle.net/tg3njfmu/1/
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2022-06-08 13:20 PDT by Ahmad Saleem
Modified: 2022-06-23 22:14 PDT (History)
9 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Ahmad Saleem 2022-06-08 13:20:39 PDT 
Hi Team,

I hope you are doing great.

Based on below attached JS Fiddle, I am able to reopen closed tabs (CMD+SHIFT+T) behavior via HTML.

JSFiddle - https://jsfiddle.net/tg3njfmu/1/show/

HTML - <button onclick="document.execCommand('undo', false, null);">undo</button>

NOTE - Tab Reopening does not work in "Private Mode".

Expected Results - It should not reopen "closed tabs" like other browsers.

Actual Results - In non-private window, it reopens "closed tabs".

I noticed that Google Chrome team changed it deeming possible security risks in following commit - https://chromium.googlesource.com/chromium/src/+/512508f0d652a006407ce66aafcd339b296a5276


Appreciate if you can look into this. Thanks!
Comment 1 Radar WebKit Bug Importer 2022-06-15 13:21:22 PDT 
<rdar://problem/95233426>
Comment 2 Ryosuke Niwa 2022-06-23 22:14:55 PDT 
This is a pretty well known old bug. Fixing it basically means we'll be decoupling WebKit's undo stack from application's NSUndoManager so there are some interesting implications.