<!DOCTYPE qhelp PUBLIC

"-//Semmle//qhelp//EN"

"qhelp.dtd">

<qhelp>

<overview>

<p>

HTML links that open in a new tab or window allow the target page to access the DOM

of the origin page using <code>window.opener</code> unless link type <code>noopener</code>

or <code>noreferrer</code> is specified. This is a potential security risk.

</p>

<p>

Note that only older browsers, where <code>target="_blank"</code> does not imply <code>rel="noopener"</code>,

are affected by this vulnerability. Modern browsers implicitly add <code>rel="noopener"</code> to

<code>target="_blank"</code> links.

Refer to the <a href="https://developer.mozilla.org/en-US/docs/Web/HTML/Element/a#browser_compatibility">browser compatibility section

on the anchor element</a> for details on which browsers implicitly add <code>rel="noopener"</code> to <code>target="_blank"</code> links.

</p>

</overview>

<recommendation>

<p>

Specify the link type by adding an attribute <code>rel="noopener noreferrer"</code>.

</p>

</recommendation>

<example>

<p>

In the following example, a JSX element is created that corresponds to an HTML

link opening the URL <code>http://example.com</code> in a new tab. Since it does

not specify a link type, that page will be able to access the DOM of the origin page.

</p>

<sample src="examples/TargetBlank.js" />

<p>

To fix this vulnerability, add a <code>rel</code> attribute:

</p>

<sample src="examples/TargetBlankGood.js" />

</example>

<references>

<li>Mathias Bynens: <a href="https://mathiasbynens.github.io/rel-noopener/">About rel=noopener</a>.</li>

<li>Mozilla Developer Network: <a href="https://developer.mozilla.org/en-US/docs/Web/HTML/Element/a">HTML Anchor Element</a>.</li>

</references>

</qhelp>