window.open(url, '_blank') hands the opened page a window.opener reference. The
URL is built from config.serverUrl, which on Viya is a different origin from the
app, so the SAS log page could navigate this tab - a log page is exactly the sort
of thing that gets rendered from backend content.
'noopener' in the window features drops the reference in every browser that
supports it. The two existing specs asserted the call's two arguments, so they
now assert the third; the client suite is 603/603 with handsontable 18.1.1 from
the lockfile.
dc
072a133702