Add rel=”noopener” to target="_blank" links to appease CodeQL. #4463
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
CodeQL explicitly says "or" but it's requiring "and".
|
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## master #4463 +/- ##
=======================================
Coverage 97.13% 97.13%
=======================================
Files 385 385
Lines 8200 8200
=======================================
Hits 7965 7965
Misses 235 235 ☔ View full report in Codecov by Sentry. |
|
It only trips up on links with |
|
oh no, I ended up with fancy quotes in here somehow. Very strange. This was the cause of CodeQL not understanding the rel attribute |
martinemde
force-pushed
the
martinemde/rel-noopener
branch
from
6357c86 to
215e908
Compare
martinemde
force-pushed
the
martinemde/rel-noopener
branch
from
215e908 to
195f0bc
Compare
segiddins
approved these changes
Feb 19, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
In #4462, CodeQL is making noise about
target="_blank"links withoutrel="noopener". I added it here to quiet CodeQL in future PRs. I doubt that any self respecting client is actually breaking this rule, but might as well.It has also been suggested, and we do this in a few places, to add
noreferreras inrel="noopener noreferrer". I don't think it's necessary as long as CodeQL is fine with it.For email, I suggest that we remove the target attribute entirely and allow the email client to do its thing.
What do you think? Should we...