Summary
Many external links throughout the UI open with target="_blank" but no rel:
<Link to={forumUrl} target="_blank"> ...
<Link to={"http://" + lastIp} target="_blank"> ... // value derived from server data
<a href={url} target="_blank"> ...Opening a link in a new tab without rel="noopener" gives the opened page access to window.opener (reverse-tabnabbing) and leaks a referrer. Modern browsers now imply noopener for target="_blank" by default, so this is defense-in-depth / hygiene rather than an active hole — but setting it explicitly is best practice, is robust against older/edge browsers, and is especially worth it for the one link built from server-provided data (TonieboxCard box IP).
Scope
Add rel="noopener noreferrer" to every external target="_blank" link that lacks a rel (a consistent, mechanical sweep across ~23 files). No behavioral change otherwise.
PR follows, targeted at develop.
Summary
Many external links throughout the UI open with
target="_blank"but norel:Opening a link in a new tab without
rel="noopener"gives the opened page access towindow.opener(reverse-tabnabbing) and leaks a referrer. Modern browsers now implynoopenerfortarget="_blank"by default, so this is defense-in-depth / hygiene rather than an active hole — but setting it explicitly is best practice, is robust against older/edge browsers, and is especially worth it for the one link built from server-provided data (TonieboxCardbox IP).Scope
Add
rel="noopener noreferrer"to every externaltarget="_blank"link that lacks arel(a consistent, mechanical sweep across ~23 files). No behavioral change otherwise.PR follows, targeted at
develop.