About rel=noopener

#1

Post by dmnd » Sat, Apr 23, 2016, 1:54 AM UTC

About rel=noopener
mathiasbynens.github.io

Re: About rel=noopener

#2

Post by _RPM » Sat, Apr 23, 2016, 2:51 AM UTC

Does this "work" for cross origin requests? If I plant a `target=_blank` in my website, user clicks it, goes to my second website, do I have control over the website the link came from? If not, I don't see the security issue. Of course you can XSS yourself, what have you.

Re: About rel=noopener

#3

Post by donatj » Sat, Apr 23, 2016, 2:53 AM UTC

Well I just had an "Oh sh*t" moment thinking about all the websites I built over the years at my old company that had target=_blank to commentors sites... Aw crap.

Not my problem anymore, but I never even considered this.

Re: About rel=noopener

#4

Post by educar » Sat, Apr 23, 2016, 2:53 AM UTC

_RPM wrote: post #2

Does this "work" for cross origin requests? If I plant a `target=_blank` in my website, user clicks it, goes to my second website, do I have control over the website the link came from? If not, I don't see the security issue. Of course you can XSS yourself, what have you.

Yes, it says so lower down the article.

Re: About rel=noopener

#5

Post by pmalynin » Sat, Apr 23, 2016, 2:54 AM UTC

This is a pretty old bug, I think I reported it a few years ago to Google.

EDIT: 2013 to be exact.

Re: About rel=noopener

#6

Post by jklinger410 » Sat, Apr 23, 2016, 2:57 AM UTC

Ths is a problem for Browsers, not developers. target=_blank is too embedded into the web.

Re: About rel=noopener

#7

Post by jaredsohn » Sat, Apr 23, 2016, 2:57 AM UTC

pmalynin wrote: post #5

This is a pretty old bug, I think I reported it a few years ago to Google. EDIT: 2013 to be exact.

FYI, the article links to a Chromium issue from 2013:

https://bugs.chromium.org/p/chromium/issues/detail?id=168988

which links to another issue from 2012.

Edit: My purpose was to confirm the bug has been "known" for awhile, not to take away credit for you reporting the bug years ago. Congrats for independently discovering it before many people (such as myself) became aware of it.

Re: About rel=noopener

#8

Post by pmalynin » Sat, Apr 23, 2016, 3:01 AM UTC

jaredsohn wrote: post #7

pmalynin wrote: post #5

This is a pretty old bug, I think I reported it a few years ago to Google. EDIT: 2013 to be exact.

FYI, the article links to a Chromium issue from 2013: https://bugs.chromium.org/p/chromium/issues/detail?id=168988 which links to another issue from 2012. Edit: My purpose was to confirm the bug has been "known" for awhile, not to take away credit for you reporting the bug years ago. Congrats for independently discovering it before many people (such as myself) became aware of it.

Well there you go, although I submitted it trough a different channel.

For sure, I think its a very important bug that hasn't had much attention for years now, especially since so many websites use _blank, GMail being one of them.

Re: About rel=noopener

#9

Post by kalmi10 » Sat, Apr 23, 2016, 3:01 AM UTC

_RPM wrote: post #2

Does this "work" for cross origin requests? If I plant a `target=_blank` in my website, user clicks it, goes to my second website, do I have control over the website the link came from? If not, I don't see the security issue. Of course you can XSS yourself, what have you.

To some extent.. Yes.

The attacker can replace the current page with his own phising page.

Of course, the hostname part of the url would change, but the user is unlikely to notice that.

Re: About rel=noopener

#10

Post by detaro » Sat, Apr 23, 2016, 3:06 AM UTC

If you open a page of your own site that then redirects to the target (like some pages do, presumably to hide the exact source URL in the referer-header before there was a header for it), is the opener-reference broken?