Add rel="noopener noreferrer" to target="_blank".

[EdOverflow]

rel="noopener noreferrer" should be added to links containing target="_blank" as a precaution against reverse tabnabbing. For more information, please refer to the following article:
https://www.jitbit.com/alexblog/256-targetblank---the-most-underestimated-vulnerability-ever/

AsciiDoc: http://example.com[Link^]
HTML: <a href="http://example.com" target="_blank">Link</a>
Fix: <a href="http://example.com" target="_blank" rel="noopener noreferrer">Link</a>

attrs << %( target="#{node.attr 'window'}") if node.attr? 'window', nil, false
%(<a href="#{target}"#{attrs.join}>#{node.text}</a>)

Link to source code: https://github.com/asciidoctor/asciidoctor/blob/master/lib/asciidoctor/converter/html5.rb#L1033

[mojavelinux]

Thank you for bringing this up for discussion. I now understand the vulnerability.

@hsablonniere what are your thoughts about this? Do you think we should add this if target is _blank? FWIW, Jake seems to like it. See https://jakearchibald.com/2016/performance-benefits-of-rel-noopener/.

It seems like Firefox has fixed this problem in Firefox 52, so perhaps we don't need the exception for Firefox anymore. We can just go with rel="noopener".

[mojavelinux]

Btw, I found this site by mathias to be very helpful in understand the issue. https://mathiasbynens.github.io/rel-noopener/

[hsablonniere]

Hey, I read mathias and Jake's article when they got out. This is very important. I would say 100% agree for noopener. I'm a bit less enthusiastic about noreferrer because of analytics but it seems to be the solution for old browsers right?

[EdOverflow]

I'm a bit less enthusiastic about noreferrer because of analytics but it seems to be the solution for old browsers right?

Yep, that is correct.

[hsablonniere]

Then I would say, let's to this and put an attribute to opt-out.

[mojavelinux]

I'm prepared to add rel="noopener", but I don't think we should add "noreferrer". Trying to cater to older browsers is futile because there are numerous other security exploits those browsers are susceptible to. If the user wants to be secure, then the user should be using the latest browser. The user can then expect that we do our part to protect them from our side. That's the contract.

[mojavelinux]

If the value of the window attribute is _blank, we'll automatically add rel="noopener". For any other value, you can set the noopener option to get the same behavior.