Skip to content

Commit 072a518

Browse files
aflores-qbaflores-qb
committed
harden: add rel="noopener noreferrer" to external target="_blank" links
Links opened with target="_blank" but no rel give the opened page window.opener access (reverse-tabnabbing) and leak a referrer. Add rel="noopener noreferrer" to every external target="_blank" link that lacked a rel (mechanical, no behavioral change). Notably covers the TonieboxCard link built from server-provided box IP. Fixes #308
1 parent c9ebc93 commit 072a518

24 files changed

Lines changed: 50 additions & 64 deletions

File tree

‎package-lock.json‎

Lines changed: 1 addition & 14 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎src/components/common/footer/StyledFooter.tsx‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ export const StyledFooter = () => {
8989
? gitHubTCCommitTreeBaseUrl + commitGitSha
9090
: gitHubTCReleasesUrl + "tag/tc_" + versionShort
9191
}
92-
target="_blank"
92+
target="_blank" rel="noopener noreferrer"
9393
>
9494
<HiddenDesktop>
9595
{versionShort} ({commitGitShaShort})
@@ -112,7 +112,7 @@ export const StyledFooter = () => {
112112
? gitHubTCCommitTreeBaseUrl + latestDevelopSHA
113113
: gitHubTCReleasesUrl + "tag/" + latestReleaseVersion
114114
}
115-
target="_blank"
115+
target="_blank" rel="noopener noreferrer"
116116
style={{
117117
display: "inline-flex",
118118
alignItems: "center",
@@ -136,7 +136,7 @@ export const StyledFooter = () => {
136136
<b>
137137
<Link
138138
to={gitHubSponsoringUrl}
139-
target="_blank"
139+
target="_blank" rel="noopener noreferrer"
140140
style={{ paddingLeft: 8 }}
141141
>
142142
{t("footer.sponsor")}

‎src/components/community/CommunitySubNav.tsx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -300,7 +300,7 @@ export const CommunitySubNav = () => {
300300
label: (
301301
<Link
302302
to={forumUrl}
303-
target="_blank"
303+
target="_blank" rel="noopener noreferrer"
304304
onClick={() => {
305305
setNavOpen(false);
306306
setSubNavOpen(false);

‎src/components/home/HomeSubNav.tsx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,7 @@ export const HomeSubNav = () => {
109109
label: (
110110
<Link
111111
to={gitHubSponsoringUrl}
112-
target="_blank"
112+
target="_blank" rel="noopener noreferrer"
113113
onClick={() => {
114114
setNavOpen(false);
115115
setSubNavOpen(false);

‎src/components/home/features/Features.tsx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ export const Features = () => {
3232
? gitHubTCCommitTreeBaseUrl + commitGitSha
3333
: gitHubTCReleasesUrl + "tag/tc_" + versionShort
3434
}
35-
target="_blank"
35+
target="_blank" rel="noopener noreferrer"
3636
>
3737
{version.replace(versionShort, "")} {<ExportOutlined />}
3838
</Link>

‎src/components/home/home/Home.tsx‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,7 @@ export const Home = () => {
8787
? gitHubTCCommitTreeBaseUrl + latestDevelopSHA
8888
: gitHubTCReleasesUrl + "tag/" + latestReleaseVersion
8989
}
90-
target="_blank"
90+
target="_blank" rel="noopener noreferrer"
9191
style={{
9292
display: "inline-flex",
9393
alignItems: "center",
@@ -178,7 +178,7 @@ export const Home = () => {
178178

179179
<Paragraph>
180180
{t("home.forumIntroPart1")}
181-
<Link to={forumUrl} target="_blank">
181+
<Link to={forumUrl} target="_blank" rel="noopener noreferrer">
182182
{forumUrl} {<ExportOutlined />}
183183
</Link>
184184
{t("home.forumIntroPart2")}
@@ -200,22 +200,22 @@ export const Home = () => {
200200
<Link to="/community/faq">FAQ</Link>
201201
</li>
202202
<li>
203-
<Link to={gitHubUrl} target="_blank">
203+
<Link to={gitHubUrl} target="_blank" rel="noopener noreferrer">
204204
GitHub {<ExportOutlined />}
205205
</Link>
206206
</li>
207207
<li>
208-
<Link to={telegramGroupUrl} target="_blank">
208+
<Link to={telegramGroupUrl} target="_blank" rel="noopener noreferrer">
209209
Telegram Chat {<ExportOutlined />}
210210
</Link>
211211
</li>
212212
<li>
213-
<Link to={forumUrl} target="_blank">
213+
<Link to={forumUrl} target="_blank" rel="noopener noreferrer">
214214
Discourse Forum {<ExportOutlined />}
215215
</Link>
216216
</li>
217217
<li>
218-
<Link to={wikiUrl} target="_blank">
218+
<Link to={wikiUrl} target="_blank" rel="noopener noreferrer">
219219
TeddyCloud Wiki {<ExportOutlined />}
220220
</Link>
221221
</li>

‎src/components/settings/SettingsSubNav.tsx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -281,7 +281,7 @@ export const SettingsSubNav = () => {
281281
label: (
282282
<Link
283283
to={`${extractBaseUrl(new URL(window.location.href))}/legacy.html`}
284-
target="_blank"
284+
target="_blank" rel="noopener noreferrer"
285285
onClick={() => {
286286
setNavOpen(false);
287287
setSubNavOpen(false);

‎src/components/tonieboxes/boxsetup/OpenBoxGuide.tsx‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -120,19 +120,19 @@ export const OpenBoxGuide: React.FC = () => {
120120
<>
121121
<Paragraph style={{ fontSize: "small" }}>
122122
{t("tonieboxes.boxSetup.openBoxGuide.guideSourcePart1")}{" "}
123-
<Link to={t("tonieboxes.boxSetup.openBoxGuide.link1")} target="_blank">
123+
<Link to={t("tonieboxes.boxSetup.openBoxGuide.link1")} target="_blank" rel="noopener noreferrer">
124124
iFixit[1] {<ExportOutlined />}
125125
</Link>{" "}
126126
{t("tonieboxes.boxSetup.openBoxGuide.guideSourcePart2")}{" "}
127-
<Link to={t("tonieboxes.boxSetup.openBoxGuide.link2")} target="_blank">
127+
<Link to={t("tonieboxes.boxSetup.openBoxGuide.link2")} target="_blank" rel="noopener noreferrer">
128128
iFixit[2] {<ExportOutlined />}
129129
</Link>
130130
. {t("tonieboxes.boxSetup.openBoxGuide.guideSourcePart3")}{" "}
131131
<Link to="https://www.ifixit.com/User/828031/Tobias+Isakeit">
132132
Tobias Isakeit {<ExportOutlined />}
133133
</Link>{" "}
134134
{t("tonieboxes.boxSetup.openBoxGuide.guideSourcePart4")}{" "}
135-
<Link to="https://creativecommons.org/licenses/by-nc-sa/3.0/" target="_blank">
135+
<Link to="https://creativecommons.org/licenses/by-nc-sa/3.0/" target="_blank" rel="noopener noreferrer">
136136
{t("tonieboxes.boxSetup.openBoxGuide.guideSourceLicense")} {<ExportOutlined />}
137137
</Link>
138138
</Paragraph>
@@ -143,7 +143,7 @@ export const OpenBoxGuide: React.FC = () => {
143143

144144
<Paragraph>
145145
{t("tonieboxes.boxSetup.openBoxGuide.alternativeGuidelineVideo")}{" "}
146-
<Link to="https://www.youtube.com/watch?v=Cv9ID4-P6_A" target="_blank">
146+
<Link to="https://www.youtube.com/watch?v=Cv9ID4-P6_A" target="_blank" rel="noopener noreferrer">
147147
https://www.youtube.com/watch?v=Cv9ID4-P6_A {<ExportOutlined />}
148148
</Link>
149149
</Paragraph>

‎src/components/tonieboxes/boxsetup/boxsetupoverview/boxsetup.tsx‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -116,7 +116,7 @@ export const BoxSetupContent: React.FC = () => {
116116
<ul>
117117
{reachableNewbieGuideUrls.map(({ id, url, title }) => (
118118
<li key={id}>
119-
<a href={url} target="_blank">
119+
<a href={url} target="_blank" rel="noopener noreferrer">
120120
{title} {<ExportOutlined />}
121121
</a>
122122
</li>
@@ -174,11 +174,11 @@ export const BoxSetupContent: React.FC = () => {
174174

175175
<Paragraph style={{ marginTop: 16 }}>
176176
{t("tonieboxes.boxSetup.boxSetupIntro1")}{" "}
177-
<Link to={forumUrl} target="_blank">
177+
<Link to={forumUrl} target="_blank" rel="noopener noreferrer">
178178
{t("tonieboxes.boxSetup.boxSetupIntroForum")}
179179
</Link>{" "}
180180
{t("tonieboxes.boxSetup.boxSetupIntro2")}{" "}
181-
<Link to={telegramGroupUrl} target="_blank">
181+
<Link to={telegramGroupUrl} target="_blank" rel="noopener noreferrer">
182182
{t("tonieboxes.boxSetup.boxSetupIntroTelegram")}
183183
</Link>{" "}
184184
{t("tonieboxes.boxSetup.boxSetupIntro3")}

‎src/components/tonieboxes/boxsetup/cc3200/elements/InstallCC3200Tool.tsx‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ export function installCC3200Tool(): JSX.Element {
1717
<ul>
1818
<li>
1919
{t("tonieboxes.boxFlashingCommon.installCC3200Tool.pythonText1")}
20-
<Link to="https://www.python.org/downloads/" target="_blank">
20+
<Link to="https://www.python.org/downloads/" target="_blank" rel="noopener noreferrer">
2121
{t("tonieboxes.boxFlashingCommon.installCC3200Tool.pythonTextLink")}{" "}
2222
{<ExportOutlined />}
2323
</Link>
@@ -27,7 +27,7 @@ export function installCC3200Tool(): JSX.Element {
2727
{t("tonieboxes.boxFlashingCommon.installCC3200Tool.gitText1")}
2828
<Link
2929
to="https://git-scm.com/book/en/v2/Getting-Started-Installing-Git"
30-
target="_blank"
30+
target="_blank" rel="noopener noreferrer"
3131
>
3232
{t("tonieboxes.boxFlashingCommon.installCC3200Tool.gitTextLink")}{" "}
3333
{<ExportOutlined />}
@@ -36,7 +36,7 @@ export function installCC3200Tool(): JSX.Element {
3636
</li>
3737
<li>
3838
{t("tonieboxes.boxFlashingCommon.installCC3200Tool.pipText1")}
39-
<Link to="https://pip.pypa.io/en/stable/installation/" target="_blank">
39+
<Link to="https://pip.pypa.io/en/stable/installation/" target="_blank" rel="noopener noreferrer">
4040
{t("tonieboxes.boxFlashingCommon.installCC3200Tool.pipTextLink")}{" "}
4141
{<ExportOutlined />}
4242
</Link>
@@ -63,7 +63,7 @@ export function installCC3200Tool(): JSX.Element {
6363
<Paragraph>
6464
{t("tonieboxes.boxFlashingCommon.installCC3200Tool.moreInformation")}
6565
</Paragraph>
66-
<Link to="https://github.com/toniebox-reverse-engineering/cc3200tool" target="_blank">
66+
<Link to="https://github.com/toniebox-reverse-engineering/cc3200tool" target="_blank" rel="noopener noreferrer">
6767
{t("tonieboxes.boxFlashingCommon.installCC3200Tool.link")} {<ExportOutlined />}
6868
</Link>
6969
</>

0 commit comments

Comments
 (0)