🛡️ Sentinel: [MEDIUM] Fix reverse tabnabbing vulnerability in external links#75
🛡️ Sentinel: [MEDIUM] Fix reverse tabnabbing vulnerability in external links#75darksheer wants to merge 1 commit into
Conversation
Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
📝 WalkthroughWalkthroughThis pull request systematically updates external links across five Vue component files to improve security and correctness. All links that open in new tabs now include ChangesExternal link security attributes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@research/f3-snapshot-1835d4f/src/views/DesignPrinciplesView.vue`:
- Around line 28-29: The footnote anchor in the DesignPrinciplesView.vue
template renders <a href=""> which opens an empty new tab; either replace the
empty href with the real citation URL or remove the anchor and render the
citation as plain text. Locate the paragraph that contains the <sup><a
...>1</a></sup> markup and update the <a> element to use the correct external
URL (including target and rel attributes) or remove the <a> entirely and leave
the "1" in plain text to avoid a broken link.
In `@research/f3-snapshot-1835d4f/src/views/TechniqueView.vue`:
- Around line 23-24: The ATT&CK shortcut anchor in TechniqueView.vue currently
uses just “&” as visible text, so update the anchor rendered when
technique.isAttack to include an aria-label (e.g. "Open the corresponding MITRE
ATT&CK page in a new tab") so screen readers get a meaningful name; locate the
<a> that calls getAttackURL() and add aria-label="Open the corresponding MITRE
ATT&CK page in a new tab" (or bind a localized string) while keeping
target="_blank" and rel="noopener noreferrer".
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: c8dfa80b-a146-4c64-a923-a01f429e2e45
📒 Files selected for processing (5)
research/f3-snapshot-1835d4f/src/components/NavigationFooter.vueresearch/f3-snapshot-1835d4f/src/views/ContactUsView.vueresearch/f3-snapshot-1835d4f/src/views/DesignPrinciplesView.vueresearch/f3-snapshot-1835d4f/src/views/HomeView.vueresearch/f3-snapshot-1835d4f/src/views/TechniqueView.vue
| <p>The initial release focuses on financial fraud as seen by banking institutions<sup><a href="" | ||
| target="blank">1</a></sup>. </p> | ||
| target="_blank" rel="noopener noreferrer">1</a></sup>. </p> |
There was a problem hiding this comment.
Replace the empty footnote destination.
Line 28 still renders footnote 1 with href="", so this now opens a useless new tab instead of the cited source. Please either point it at the real reference URL or render plain text until that citation exists.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@research/f3-snapshot-1835d4f/src/views/DesignPrinciplesView.vue` around lines
28 - 29, The footnote anchor in the DesignPrinciplesView.vue template renders <a
href=""> which opens an empty new tab; either replace the empty href with the
real citation URL or remove the anchor and render the citation as plain text.
Locate the paragraph that contains the <sup><a ...>1</a></sup> markup and update
the <a> element to use the correct external URL (including target and rel
attributes) or remove the <a> entirely and leave the "1" in plain text to avoid
a broken link.
| <h1> {{ technique?.name }} <a v-if="technique.isAttack" :href="getAttackURL()" class="attack-indicator" | ||
| target="_blank">&</a></h1> | ||
| target="_blank" rel="noopener noreferrer">&</a></h1> |
There was a problem hiding this comment.
Add an accessible label to the ATT&CK shortcut link.
The link’s visible text is only &, so assistive tech gets an unhelpful name here. Adding an aria-label like “Open the corresponding MITRE ATT&CK page in a new tab” would make the control understandable.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@research/f3-snapshot-1835d4f/src/views/TechniqueView.vue` around lines 23 -
24, The ATT&CK shortcut anchor in TechniqueView.vue currently uses just “&” as
visible text, so update the anchor rendered when technique.isAttack to include
an aria-label (e.g. "Open the corresponding MITRE ATT&CK page in a new tab") so
screen readers get a meaningful name; locate the <a> that calls getAttackURL()
and add aria-label="Open the corresponding MITRE ATT&CK page in a new tab" (or
bind a localized string) while keeping target="_blank" and rel="noopener
noreferrer".
1 participant
🚨 Severity: MEDIUM
💡 Vulnerability: Several external links using
target="_blank"(or the invalidtarget="blank") were missing therel="noopener noreferrer"attribute. This allows the newly opened tab to retain a reference to the original page'swindow.openerobject, making the application vulnerable to reverse tabnabbing attacks, where a malicious external site can redirect the original page to a phishing site.🎯 Impact: If a legitimate external link is compromised or redirected, the attacker could exploit the
window.openerreference to navigate the user's original tab to a malicious site, potentially stealing credentials or sensitive information.🔧 Fix: Added
rel="noopener noreferrer"to alltarget="_blank"anchor tags across Vue components (NavigationFooter.vue,ContactUsView.vue,DesignPrinciplesView.vue,HomeView.vue,TechniqueView.vue). Also corrected invalidtarget="blank"attributes totarget="_blank".✅ Verification: Verified that external links in the UI now include the secure
relattribute and run the frontend build and lint processes successfully.PR created automatically by Jules for task 14161173859279720080 started by @darksheer
Summary by CodeRabbit
Bug Fixes