Skip to content

Adds noref/noopen to external links for Mailgun and Snowplow

Greg Myers requested to merge integration-settings-link-target-noopen-noref into master

What does this MR do and why?

Adds rel="noopener noreferrer" to external links for Mailgun and Snowplow in the admin/settings/general menu.

This is a best practice to avoid "Reverse Tabnapping".

Screenshots or screen recordings

This was surfaced by running an authenticated DAST active scan on a self-managed GitLab instance.

dast-scan-results

links

mailgun

snowplow

How to set up and validate locally

  1. Navigate to admin/settings/general in GitLab instance

  2. Inspect links for Mailgun and Snowplow, note that they have target="_blank" but do not have rel="noopener noreferrer".

  3. Edit _mailgun.html.haml:11 and _snowplow.html.haml:10

    app/views/admin/application_settings/_mailgun.html.haml:11

    --      = _('Configure the %{link} integration.').html_safe % { link: link_to(_('Mailgun events'), 'https://documentation.mailgun.com/en/latest/user_manual.html#webhooks', target: '_blank') }
    ++      = _('Configure the %{link} integration.').html_safe % { link: link_to(_('Mailgun events'), 'https://documentation.mailgun.com/en/latest/user_manual.html#webhooks', target: '_blank', rel: 'noopener noreferrer') }

    app/views/admin/application_settings/_snowplow.html.haml:10

    --       = html_escape(_('Configure %{link} to track events. %{link_start}Learn more.%{link_end}')) % { link: link_to('Snowplow', 'https://snowplowanalytics.com/', target: '_blank').html_safe, link_start: link_start, link_end: '</a>'.html_safe }
    ++       = html_escape(_('Configure %{link} to track events. %{link_start}Learn more.%{link_end}')) % { link: link_to('Snowplow', 'https://snowplowanalytics.com/', target: '_blank', rel: 'noopener noreferrer').html_safe, link_start: link_start, link_end: '</a>'.html_safe }
  4. Verify that the links for Mailgun and Snowplow now have rel="noopener noreferrer". 🎉

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Greg Myers

Merge request reports

Loading