midgard/MapComplete
1
0
Fork 0
forked from MapComplete/MapComplete
Code Pull requests Activity

Fix: fix reverse tabnabbing in most cases, add rel=noopener to most links to untrusted content

Browse source
This commit is contained in:
Pieter Vander Vennet 2023-09-02 00:55:07 +02:00
parent fd39f66e2e
commit d9b8257e47
25 changed files with 462 additions and 77 deletions
Download patch file Download diff file Expand all files Collapse all files

1
src/UI/Base/SubtleLink.svelte
View file

@ -34,6 +34,7 @@
class={twMerge(options.extraClasses, "button text-ellipsis")}
{href}
target={newTab ? "_blank" : undefined}
rel={newTab ? "noopener" : undefined}
>
<slot name="image">
{#if imageUrl !== undefined}

2
src/UI/BigComponents/ContactLink.svelte
View file

@ -35,7 +35,7 @@
src={`https://raw.githubusercontent.com/pietervdvn/MapComplete-data/main/community_index/${resource.type}.svg`}
/>
<div class="flex flex-col">
<a href={resource.resolved.url} target="_blank" rel="noreferrer nofollow" class="font-bold">
<a href={resource.resolved.url} target="_blank" rel="noreferrer nofollow noopener" class="font-bold">
{resource.resolved.name ?? resource.resolved.url}
</a>
{resource.resolved?.description}

2
src/UI/BigComponents/CopyrightPanel.ts
View file

@ -102,7 +102,7 @@ export default class CopyrightPanel extends Combine {
let bgAttr: BaseUIElement | string = undefined
if (attrText && attrUrl) {
bgAttr =
"<a href='" + attrUrl + "' target='_blank'>" + attrText + "</a>"
"<a href='" + attrUrl + "' target='_blank' rel='noopener'>" + attrText + "</a>"
} else if (attrUrl) {
bgAttr = attrUrl
} else {

1
src/UI/BigComponents/UserProfile.svelte
View file

@ -37,6 +37,7 @@
<a
href={osmConnection.Backend() + "/profile/edit"}
target="_blank"
rel="noopener"
class="link-no-underline flex items-center self-end"
>
<PencilAltIcon slot="image" class="h-8 w-8 p-2" />

2
src/UI/SpecialVisualizations.ts
View file

@ -1250,7 +1250,7 @@ export default class SpecialVisualizations {
},
{
funcName: "link",
docs: "Construct a link. By using the 'special' visualisation notation, translation should be easier",
docs: "Construct a link. By using the 'special' visualisation notation, translations should be easier",
args: [
{
name: "text",