Bug 241432

Summary:	execCommand('undo') allows to restore closed tabs from HTML
Product:	WebKit	Reporter:	Ahmad Saleem <ahmad.saleem792>
Component:	HTML Editing	Assignee:	Nobody <webkit-unassigned>
Status:	NEW ---
Severity:	Normal	CC:	ap, eric.carlson, mattwoodrow, mjs, rniwa, webkit-bug-importer, wenson_hsieh, wilander, zalan
Priority:	P2	Keywords:	InRadar
Version:	Safari 15
Hardware:	Mac (Apple Silicon)
OS:	macOS 10.15
URL:	https://jsfiddle.net/tg3njfmu/1/

Description Ahmad Saleem 2022-06-08 13:20:39 PDT

Hi Team,

I hope you are doing great.

Based on below attached JS Fiddle, I am able to reopen closed tabs (CMD+SHIFT+T) behavior via HTML.

JSFiddle - https://jsfiddle.net/tg3njfmu/1/show/

HTML - <button onclick="document.execCommand('undo', false, null);">undo</button>

NOTE - Tab Reopening does not work in "Private Mode".

Expected Results - It should not reopen "closed tabs" like other browsers.

Actual Results - In non-private window, it reopens "closed tabs".

I noticed that Google Chrome team changed it deeming possible security risks in following commit - https://chromium.googlesource.com/chromium/src/+/512508f0d652a006407ce66aafcd339b296a5276


Appreciate if you can look into this. Thanks!

Comment 1 Radar WebKit Bug Importer 2022-06-15 13:21:22 PDT

<rdar://problem/95233426>

Comment 2 Ryosuke Niwa 2022-06-23 22:14:55 PDT

This is a pretty well known old bug. Fixing it basically means we'll be decoupling WebKit's undo stack from application's NSUndoManager so there are some interesting implications.