midgard/MapComplete
1
0
Fork 0
forked from MapComplete/MapComplete
Code Pull requests Activity

Fix: fix reverse tabnabbing in most cases, add rel=noopener to most links to untrusted content

Browse source
This commit is contained in:
Pieter Vander Vennet 2023-09-02 00:55:07 +02:00
parent fd39f66e2e
commit d9b8257e47
25 changed files with 462 additions and 77 deletions
Download patch file Download diff file Expand all files Collapse all files

7
src/Models/Constants.ts
View file

@ -1,13 +1,16 @@
import { Utils } from "../Utils"
import * as meta from "../../package.json"
import { Utils } from "../Utils"
export type PriviligedLayerType = (typeof Constants.priviliged_layers)[number]
export default class Constants {
static {
console.log("Meta (package:json)", meta)
}
public static vNumber = meta.version
public static ImgurApiKey = meta.config.api_keys.imgur
public static readonly mapillary_client_token_v4 =meta.config.api_keys.mapillary_v4
public static readonly mapillary_client_token_v4 = meta.config.api_keys.mapillary_v4
/**
* API key for Maproulette

2
src/Models/ThemeConfig/TagRenderingConfig.ts
View file

@ -242,7 +242,7 @@ export default class TagRenderingConfig {
if (txt === "") {
throw context + " Rendering for language " + ln + " is empty"
}
if (txt.indexOf("{" + this.freeform.key + "}") >= 0) {
if (txt.indexOf("{" + this.freeform.key + "}") >= 0 || txt.indexOf("&LBRACE" + this.freeform.key + "&RBRACE") ) {
continue
}
if (txt.indexOf("{" + this.freeform.key + ":") >= 0) {

1
src/UI/Base/SubtleLink.svelte
View file

@ -34,6 +34,7 @@
class={twMerge(options.extraClasses, "button text-ellipsis")}
{href}
target={newTab ? "_blank" : undefined}
rel={newTab ? "noopener" : undefined}
>
<slot name="image">
{#if imageUrl !== undefined}

2
src/UI/BigComponents/ContactLink.svelte
View file

@ -35,7 +35,7 @@
src={`https://raw.githubusercontent.com/pietervdvn/MapComplete-data/main/community_index/${resource.type}.svg`}
/>
<div class="flex flex-col">
<a href={resource.resolved.url} target="_blank" rel="noreferrer nofollow" class="font-bold">
<a href={resource.resolved.url} target="_blank" rel="noreferrer nofollow noopener" class="font-bold">
{resource.resolved.name ?? resource.resolved.url}
</a>
{resource.resolved?.description}

2
src/UI/BigComponents/CopyrightPanel.ts
View file

@ -102,7 +102,7 @@ export default class CopyrightPanel extends Combine {
let bgAttr: BaseUIElement | string = undefined
if (attrText && attrUrl) {
bgAttr =
"<a href='" + attrUrl + "' target='_blank'>" + attrText + "</a>"
"<a href='" + attrUrl + "' target='_blank' rel='noopener'>" + attrText + "</a>"
} else if (attrUrl) {
bgAttr = attrUrl
} else {

1
src/UI/BigComponents/UserProfile.svelte
View file

@ -37,6 +37,7 @@
<a
href={osmConnection.Backend() + "/profile/edit"}
target="_blank"
rel="noopener"
class="link-no-underline flex items-center self-end"
>
<PencilAltIcon slot="image" class="h-8 w-8 p-2" />

2
src/UI/SpecialVisualizations.ts
View file

@ -1250,7 +1250,7 @@ export default class SpecialVisualizations {
},
{
funcName: "link",
docs: "Construct a link. By using the 'special' visualisation notation, translation should be easier",
docs: "Construct a link. By using the 'special' visualisation notation, translations should be easier",
args: [
{
name: "text",