{"action":"created","issue":{"url":"https://api.github.com/repos/rails/rails/issues/25548","repository_url":"https://api.github.com/repos/rails/rails","labels_url":"https://api.github.com/repos/rails/rails/issues/25548/labels{/name}","comments_url":"https://api.github.com/repos/rails/rails/issues/25548/comments","events_url":"https://api.github.com/repos/rails/rails/issues/25548/events","html_url":"https://github.com/rails/rails/pull/25548","id":162592596,"number":25548,"title":"[wip] adding rel=noopener for link_to when target=blank_","user":{"login":"Jxck","id":322289,"avatar_url":"https://avatars.githubusercontent.com/u/322289?v=3","gravatar_id":"","url":"https://api.github.com/users/Jxck","html_url":"https://github.com/Jxck","followers_url":"https://api.github.com/users/Jxck/followers","following_url":"https://api.github.com/users/Jxck/following{/other_user}","gists_url":"https://api.github.com/users/Jxck/gists{/gist_id}","starred_url":"https://api.github.com/users/Jxck/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Jxck/subscriptions","organizations_url":"https://api.github.com/users/Jxck/orgs","repos_url":"https://api.github.com/users/Jxck/repos","events_url":"https://api.github.com/users/Jxck/events{/privacy}","received_events_url":"https://api.github.com/users/Jxck/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rails/rails/labels/actionview","name":"actionview","color":"d7e102"}],"state":"open","locked":false,"assignee":{"login":"matthewd","id":1034,"avatar_url":"https://avatars.githubusercontent.com/u/1034?v=3","gravatar_id":"","url":"https://api.github.com/users/matthewd","html_url":"https://github.com/matthewd","followers_url":"https://api.github.com/users/matthewd/followers","following_url":"https://api.github.com/users/matthewd/following{/other_user}","gists_url":"https://api.github.com/users/matthewd/gists{/gist_id}","starred_url":"https://api.github.com/users/matthewd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/matthewd/subscriptions","organizations_url":"https://api.github.com/users/matthewd/orgs","repos_url":"https://api.github.com/users/matthewd/repos","events_url":"https://api.github.com/users/matthewd/events{/privacy}","received_events_url":"https://api.github.com/users/matthewd/received_events","type":"User","site_admin":false},"assignees":[{"login":"matthewd","id":1034,"avatar_url":"https://avatars.githubusercontent.com/u/1034?v=3","gravatar_id":"","url":"https://api.github.com/users/matthewd","html_url":"https://github.com/matthewd","followers_url":"https://api.github.com/users/matthewd/followers","following_url":"https://api.github.com/users/matthewd/following{/other_user}","gists_url":"https://api.github.com/users/matthewd/gists{/gist_id}","starred_url":"https://api.github.com/users/matthewd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/matthewd/subscriptions","organizations_url":"https://api.github.com/users/matthewd/orgs","repos_url":"https://api.github.com/users/matthewd/repos","events_url":"https://api.github.com/users/matthewd/events{/privacy}","received_events_url":"https://api.github.com/users/matthewd/received_events","type":"User","site_admin":false}],"milestone":null,"comments":16,"created_at":"2016-06-28T03:03:05Z","updated_at":"2016-10-11T01:31:48Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rails/rails/pulls/25548","html_url":"https://github.com/rails/rails/pull/25548","diff_url":"https://github.com/rails/rails/pull/25548.diff","patch_url":"https://github.com/rails/rails/pull/25548.patch"},"body":"I'm already discussed on ML here\r\nhttps://groups.google.com/d/topic/rubyonrails-core/BPGwQXKWsws/discussion\r\ncopy are on Summary\r\n\r\n### Summary\r\n\r\nlink with target=blank_ will cause some kind of phishing attack known as *tabnabbing*.\r\ndetail of this attacks are described below.\r\n\r\n- http://www.azarask.in/blog/post/a-new-type-of-phishing-attack/\r\n- https://www.jitbit.com/alexblog/256-targetblank---the-most-underestimated-vulnerability-ever/\r\n\r\nthis is caused by `window.opener` of JavaScript API, and it will prevent by `rel=noopener` new API.\r\n\r\nso I propose adding this attribute to `link_to` when it given `target: \"_blank\"`.\r\n\r\n```\r\nlink_to \"External link\", \"http://www.rubyonrails.org/\", target: \"_blank\"\r\n```\r\n\r\n```\r\n<!-- before -->\r\n<a href=\"http://www.rubyonrails.org/\" target=\"_blank\">External link</a>\r\n<!-- after -->\r\n<a href=\"http://www.rubyonrails.org/\" target=\"_blank\" rel=\"noopener\">External link</a>\r\n```\r\n\r\nhere is `noopener` spec.\r\n\r\nhttps://html.spec.whatwg.org/multipage/semantics.html#link-type-noopener\r\n\r\ncurrently implemented by chrome/opera.\r\n\r\nhttp://caniuse.com/#search=noopener\r\n\r\n`noreferrer` is considered altenative of `noopener` for older browser.\r\nbut this cause not to send referrer to server, so it'll cause breakin change for some apps.\r\n`noopener` is no side effect for apps, without using `window.opener` ofcourse.\r\n\r\n\r\n### API Change\r\n\r\nbasically `rel=noopener` will add when html option has `target=_blank` by default\r\n\r\n```ruby\r\nlink_to(\"Hello\", url_hash, { target: \"_blank\" })\r\n# <a target=\"_blank\" rel=\"noopener\" href=\"/\">Hello</a>\r\n```\r\n\r\nyou can opt out to adding `rel=noopener` with `opener: true` option.\r\n\r\n```ruby\r\noption = url_hash.merge({ opener: true })\r\nlink_to(\"Hello\", option, { target: \"_blank\" })\r\n# <a target=\"_blank\" href=\"/\">Hello</a>\r\n```\r\n\r\nthanks\r\nJxck"},"comment":{"url":"https://api.github.com/repos/rails/rails/issues/comments/252788392","html_url":"https://github.com/rails/rails/pull/25548#issuecomment-252788392","issue_url":"https://api.github.com/repos/rails/rails/issues/25548","id":252788392,"user":{"login":"matthewd","id":1034,"avatar_url":"https://avatars.githubusercontent.com/u/1034?v=3","gravatar_id":"","url":"https://api.github.com/users/matthewd","html_url":"https://github.com/matthewd","followers_url":"https://api.github.com/users/matthewd/followers","following_url":"https://api.github.com/users/matthewd/following{/other_user}","gists_url":"https://api.github.com/users/matthewd/gists{/gist_id}","starred_url":"https://api.github.com/users/matthewd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/matthewd/subscriptions","organizations_url":"https://api.github.com/users/matthewd/orgs","repos_url":"https://api.github.com/users/matthewd/repos","events_url":"https://api.github.com/users/matthewd/events{/privacy}","received_events_url":"https://api.github.com/users/matthewd/received_events","type":"User","site_admin":false},"created_at":"2016-10-11T01:31:48Z","updated_at":"2016-10-11T01:31:48Z","body":"I'm somewhat concerned about us mutilating a `rel` value that's been explicitly set"}}
{"actor":{"display_login":"matthewd"}}