Skip to content

feat(GlSafeLinkDirective): Add safe link directive

Dheeraj Joshi requested to merge safe-link-directive into master

What does this MR do?

This MR adds a directive to prevent security issues related to hyperlinks.

  1. Target="_blank"

Makes sure all the external urls have noopener noreferrer rel attributes. This also preserves existing values.

  1. XSS with urls

Links are vulnerable to javascript based XSS vulnerabilty, for example

<a href="javascript:alert(document.domain)">click me</a>

This directive aims to sanitize all such xss payloads by replacing them with about:blank.

Follow up MRs

MR Changes
!1472 (merged) Add it to GlLink component
!1490 (merged) Make update transformation reactive

Does this MR meet the acceptance criteria?

Conformity

  • Code review guidelines.
  • GitLab UI's contributing guidlines.
  • If it changes a Pajamas-compliant component's look & feel, the MR has been reviewed by a UX designer.
  • If it changes GitLab UI's documentation guidelines, the MR has been reviewed by a Technical Writer.
  • If the MR changes a component's API, integration MR(s) have been opened in the following projects to ensure that the @gitlab/ui package can be upgraded quickly after the changes are released:
  • Added the ~"component:*" label(s) if applicable.

Related #823 (closed)

Edited by Dheeraj Joshi

Merge request reports