fix(security): use rel=noopener on links

cf https://sonarcloud.io/project/security_hotspots?id=openwhyd_openwhyd&sinceLeakPeriod=true&tab=code
openwhyd · Oct 29, 2023 · fe64ced · fe64ced
1 parent 535412c
commit fe64ced
Show file tree

Hide file tree

Showing 4 changed files with 16 additions and 7 deletions.
diff --git a/app/templates/sideBox-maintenance.html b/app/templates/sideBox-maintenance.html
@@ -44,12 +44,14 @@ <h2>😓 Issues with YouTube API</h2>
       <a
         href="https://www.facebook.com/openwhyd"
         target="_blank"
+        rel="noopener"
         class="no-ajaxy"
         >on Facebook</a
       >
       <a
         href="https://github.com/openwhyd/openwhyd/issues/262"
         target="_blank"
+        rel="noopener"
         class="no-ajaxy"
         >on GitHub</a
       >

diff --git a/app/templates/sideBox.html b/app/templates/sideBox.html
@@ -41,10 +41,11 @@ <h2>⚠️ User accounts will evolve soon</h2>
         download="my-openwhyd-tracks.json"
         href="/me?format=json&limit=999999"
         target="_blank"
+        rel="noopener"
         class="no-ajaxy"
         >💾 &nbsp; Backup your tracks</a
       >
-      <a href="/settings" target="_blank" class="no-ajaxy"
+      <a href="/settings" target="_blank" rel="noopener" class="no-ajaxy"
         >📧 &nbsp; Update your email address</a
       >
     </div>

diff --git a/test/approval/routes/snapshots/routes.approval.tests.js.md b/test/approval/routes/snapshots/routes.approval.tests.js.md
@@ -189,10 +189,11 @@ Generated by [AVA](https://avajs.dev).
             download="my-openwhyd-tracks.json"␊
             href="/me?format=json&limit=999999"␊
             target="_blank"␊
+            rel="noopener"␊
             class="no-ajaxy"␊
             >💾 &nbsp; Backup your tracks</a␊
           >␊
-          <a href="/settings" target="_blank" class="no-ajaxy"␊
+          <a href="/settings" target="_blank" rel="noopener" class="no-ajaxy"␊
             >📧 &nbsp; Update your email address</a␊
           >␊
         </div>␊
@@ -2570,10 +2571,11 @@ Generated by [AVA](https://avajs.dev).
             download="my-openwhyd-tracks.json"␊
             href="/me?format=json&limit=999999"␊
             target="_blank"␊
+            rel="noopener"␊
             class="no-ajaxy"␊
             >💾 &nbsp; Backup your tracks</a␊
           >␊
-          <a href="/settings" target="_blank" class="no-ajaxy"␊
+          <a href="/settings" target="_blank" rel="noopener" class="no-ajaxy"␊
             >📧 &nbsp; Update your email address</a␊
           >␊
         </div>␊
@@ -5353,10 +5355,11 @@ Generated by [AVA](https://avajs.dev).
             download="my-openwhyd-tracks.json"␊
             href="/me?format=json&limit=999999"␊
             target="_blank"␊
+            rel="noopener"␊
             class="no-ajaxy"␊
             >💾 &nbsp; Backup your tracks</a␊
           >␊
-          <a href="/settings" target="_blank" class="no-ajaxy"␊
+          <a href="/settings" target="_blank" rel="noopener" class="no-ajaxy"␊
             >📧 &nbsp; Update your email address</a␊
           >␊
         </div>␊
@@ -23072,10 +23075,11 @@ Generated by [AVA](https://avajs.dev).
             download="my-openwhyd-tracks.json"␊
             href="/me?format=json&limit=999999"␊
             target="_blank"␊
+            rel="noopener"␊
             class="no-ajaxy"␊
             >💾 &nbsp; Backup your tracks</a␊
           >␊
-          <a href="/settings" target="_blank" class="no-ajaxy"␊
+          <a href="/settings" target="_blank" rel="noopener" class="no-ajaxy"␊
             >📧 &nbsp; Update your email address</a␊
           >␊
         </div>␊
@@ -25450,10 +25454,11 @@ Generated by [AVA](https://avajs.dev).
             download="my-openwhyd-tracks.json"␊
             href="/me?format=json&limit=999999"␊
             target="_blank"␊
+            rel="noopener"␊
             class="no-ajaxy"␊
             >💾 &nbsp; Backup your tracks</a␊
           >␊
-          <a href="/settings" target="_blank" class="no-ajaxy"␊
+          <a href="/settings" target="_blank" rel="noopener" class="no-ajaxy"␊
             >📧 &nbsp; Update your email address</a␊
           >␊
         </div>␊
@@ -28237,10 +28242,11 @@ Generated by [AVA](https://avajs.dev).
             download="my-openwhyd-tracks.json"␊
             href="/me?format=json&limit=999999"␊
             target="_blank"␊
+            rel="noopener"␊
             class="no-ajaxy"␊
             >💾 &nbsp; Backup your tracks</a␊
           >␊
-          <a href="/settings" target="_blank" class="no-ajaxy"␊
+          <a href="/settings" target="_blank" rel="noopener" class="no-ajaxy"␊
             >📧 &nbsp; Update your email address</a␊
           >␊
         </div>␊

diff --git a/test/approval/routes/snapshots/routes.approval.tests.js.snap b/test/approval/routes/snapshots/routes.approval.tests.js.snap