1864
Specify in the design that any linked external document must not be granted access to the
location object of the calling page.
Phase: Implementation
When creating a link to an external document using the <a> tag with a defined target, for
example "_blank" or a named frame, provide the rel attribute with a value "noopener noreferrer".
If opening the external document in a new window via javascript, then reset the opener by setting
it equal to null.
Phase: Implementation
Do not use "_blank" targets. However, this can affect the usability of the application.
Demonstrative Examples
Example 1:
In this example, the application opens a link in a named window/tab without taking precautions to
prevent the called page from tampering with the calling page's location in the browser.
There are two ways that this weakness is commonly seen. The first is when the application
generates an <a> tag is with target="_blank" to point to a target site:
Example Language: HTML (Bad)
<a href="http://attacker-site.example.com/useful-page.html" target="_blank">
If the attacker offers a useful page on this link (or compromises a trusted, popular site), then
a user may click on this link. However, the attacker could use scripting code to modify the
window.opener's location property to redirect the application to a malicious, attacker-controlled
page - such as one that mimics the look and feel of the original application and convinces the user
to re-enter authentication credentials, i.e. phishing:
Example Language: JavaScript (Attack)
window.opener.location = 'http://phishing.example.org/popular-bank-page';
To mitigate this type of weakness, some browsers support the "rel" attribute with a value of
"noopener", which sets the window.opener object equal to null. Another option is to use the "rel"
attribute with a value of "noreferrer", which in essence does the same thing.
Example Language: HTML (Good)
<a href="http://attacker-site.example.com/useful-page.html" target="_blank" rel="noopener noreferrer">
A second way that this weakness is commonly seen is when opening a new site directly within
JavaScript. In this case, a new site is opened using the window.open() function.
Example Language: JavaScript (Bad)
var newWindow = window.open("http://attacker-site.example.com/useful-page.html", "_blank");
To mitigate this, set the window.opener object to null.
Example Language: JavaScript (Good)
var newWindow = window.open("http://attacker-site.example.com/useful-page.html", "_blank");
newWindow.opener = null;
Observed Examples
CWE Version 4.14
CWE-1023: Incomplete Comparison with Missing Factors
CWE-1023: Incomplete Comparison with Missing Factors