1441493 - Use rel="noopener" for all target != null links

Status: RESOLVED FIXED

(Tree Management :: Treeherder: Frontend, enhancement, P1)

Description

[Ed Morley [:emorley]]

To prevent:
https://www.owasp.org/index.php/Reverse_Tabnabbing
https://mathiasbynens.github.io/rel-noopener/

Looking at browser support for `noopener`, we don't need to worry about `noreferrer` (which is a more heavy-handed option, that is only needed for older browsers):
https://caniuse.com/#search=noopener

We'll also need to ensure we don't add `noopener` to the `login.html` open() since otherwise that will break the callback handling.

Other resources:
https://www.owasp.org/index.php/HTML5_Security_Cheat_Sheet#Tabnabbing
https://html.spec.whatwg.org/multipage/links.html#link-type-noopener

Comment 1

[GitHub Bugzilla PR Linker]

Attachment: Link to GitHub pull-request: https://github.com/mozilla/treeherder/pull/3275

Comment 2

[Treeherder GitHub Bugbot]

Commit pushed to master at https://github.com/mozilla/treeherder

https://github.com/mozilla/treeherder/commit/bd870cf8cecad32df6ef395a8714f3b7395cc1d3
Bug 1441493 - Use rel="noopener" for all target != null links (#3275)

This helps prevent:
https://www.owasp.org/index.php/Reverse_Tabnabbing

We're not also using `noreferrer`, since most browsers now support
`noopener` (https://caniuse.com/#search=noopener) and the link targets
are all Mozilla properties where the referrer may be useful.

The auth.js `window.open()` has not been changed, since the login
callback makes use of `window.opener`.