hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-23 20:26:32 +01:00
Code Issues Packages Projects Releases Wiki Activity

change the precision of the js/unsafe-external-link query to low

Browse Source
This commit is contained in:
erik-krogh
2024-03-21 09:26:35 +01:00
parent 6619be3137
commit 54a1c25276
3 changed files with 13 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
javascript/ql/src/DOM/TargetBlank.qhelp
View File

@@ -9,6 +9,14 @@ of the origin page using <code>window.opener</code> unless link type <code>noope
or <code>noreferrer</code> is specified. This is a potential security risk. or <code>noreferrer</code> is specified. This is a potential security risk.
</p> </p>
<p>
Note that only older browsers, where <code>target="_blank"</code> does not imply <code>rel="noopener"</code>,
are affected by this vulnerability. Modern browsers implicitly add <code>rel="noopener"</code> to
<code>target="_blank"</code> links.
Refer to the <a href="https://developer.mozilla.org/en-US/docs/Web/HTML/Element/a#browser_compatibility">browser compatibility section
on the anchor element</a> for details on which browsers implicitly add <code>rel="noopener"</code> to <code>target="_blank"</code> links.
</p>
</overview> </overview>
<recommendation> <recommendation>

2
javascript/ql/src/DOM/TargetBlank.ql
View File

@@ -10,7 +10,7 @@
* security * security
* external/cwe/cwe-200 * external/cwe/cwe-200
* external/cwe/cwe-1022 * external/cwe/cwe-1022
* @precision very-high * @precision low
*/ */
import javascript import javascript

4
javascript/ql/src/change-notes/2024-03-21-target-blank-precision.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: queryMetadata
---
* The `@precision` of the `js/unsafe-external-link` has been lowered to `low` to reflect that modern browsers do not provider the `opener` attribute and thus mitigate the potential security risk of having a link with `target="_blank"`.