Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security] Missing rel=noreferrer and rel=noopener in links #46

Closed
Mickael-van-der-Beek opened this issue Nov 25, 2016 · 1 comment
Closed

[Security] Missing rel=noreferrer and rel=noopener in links #46

Mickael-van-der-Beek opened this issue Nov 25, 2016 · 1 comment

Comments

@Mickael-van-der-Beek
Copy link

Mickael-van-der-Beek commented Nov 25, 2016 •
edited
Loading

When a user sends a message containing a URL, Darkwire transforms the URL into an HTML anchor tag with an href link to the URL in question using the Autolinker module.

This creates two important security vulnerabilities.

  • Missing rel=noreferrer

When a user clicks on a link sent by another user in the same chat room, the request made by the browser to fetch the resource referenced by the URL will contain a Referrer header who's value will be the chatroom's full URL.

This creates an issue where any website administrator to which a Darkwire user browsed to can just look up the Darkwire chatroom URL in the Referrer header of his server logs.

  • Missing rel=noopener

Since anchor tags create by Autolinker contain a target=_blank attribute, users clicking on this link will be vulnerable to tab-jacking attacks.

More details can be found in this blog post: https://mathiasbynens.github.io/rel-noopener/
Closed
seripap added a commit that referenced this issue Nov 28, 2016
@seripap
Merge branch 'develop'
d9a51de 
* develop:
  Updated travis for lastest distro and chromedriver. Update darkwire to v1.5.8
  Adds rel=noreferrer and rel=noopener to autolinks (Fixes #46)
  Fixes XSS attack through user renaming (#47)
  Dockerfile strictly requiring njs 6.7
@seripap
Copy link
Collaborator

seripap commented Nov 28, 2016

Fixed in v1.5.8

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@seripap @Mickael-van-der-Beek