Adds noref/noopen to external links for Mailgun and Snowplow
What does this MR do and why?
Adds rel="noopener noreferrer"
to external links for Mailgun and Snowplow in the admin/settings/general
menu.
This is a best practice to avoid "Reverse Tabnapping".
Screenshots or screen recordings
This was surfaced by running an authenticated DAST active scan on a self-managed GitLab instance.
How to set up and validate locally
-
Navigate to
admin/settings/general
in GitLab instance -
Inspect links for Mailgun and Snowplow, note that they have
target="_blank"
but do not haverel="noopener noreferrer"
. -
Edit
_mailgun.html.haml:11
and_snowplow.html.haml:10
app/views/admin/application_settings/_mailgun.html.haml:11
-- = _('Configure the %{link} integration.').html_safe % { link: link_to(_('Mailgun events'), 'https://documentation.mailgun.com/en/latest/user_manual.html#webhooks', target: '_blank') } ++ = _('Configure the %{link} integration.').html_safe % { link: link_to(_('Mailgun events'), 'https://documentation.mailgun.com/en/latest/user_manual.html#webhooks', target: '_blank', rel: 'noopener noreferrer') }
app/views/admin/application_settings/_snowplow.html.haml:10
-- = html_escape(_('Configure %{link} to track events. %{link_start}Learn more.%{link_end}')) % { link: link_to('Snowplow', 'https://snowplowanalytics.com/', target: '_blank').html_safe, link_start: link_start, link_end: '</a>'.html_safe } ++ = html_escape(_('Configure %{link} to track events. %{link_start}Learn more.%{link_end}')) % { link: link_to('Snowplow', 'https://snowplowanalytics.com/', target: '_blank', rel: 'noopener noreferrer').html_safe, link_start: link_start, link_end: '</a>'.html_safe }
-
Verify that the links for Mailgun and Snowplow now have
rel="noopener noreferrer"
.🎉
MR acceptance checklist
This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.
-
I have evaluated the MR acceptance checklist for this MR.