Skip to content

Adds noref/noopen to external links for Mailgun and Snowplow

Greg Myers requested to merge integration-settings-link-target-noopen-noref into master

What does this MR do and why?

Adds rel="noopener noreferrer" to external links for Mailgun and Snowplow in the admin/settings/general menu.

This is a best practice to avoid "Reverse Tabnapping".

Screenshots or screen recordings

This was surfaced by running an authenticated DAST active scan on a self-managed GitLab instance.

dast-scan-results

links

mailgun

snowplow

How to set up and validate locally

  1. Navigate to admin/settings/general in GitLab instance

  2. Inspect links for Mailgun and Snowplow, note that they have target="_blank" but do not have rel="noopener noreferrer".

  3. Edit _mailgun.html.haml:11 and _snowplow.html.haml:10

    app/views/admin/application_settings/_mailgun.html.haml:11

    --      = _('Configure the %{link} integration.').html_safe % { link: link_to(_('Mailgun events'), 'https://documentation.mailgun.com/en/latest/user_manual.html#webhooks', target: '_blank') }
    ++      = _('Configure the %{link} integration.').html_safe % { link: link_to(_('Mailgun events'), 'https://documentation.mailgun.com/en/latest/user_manual.html#webhooks', target: '_blank', rel: 'noopener noreferrer') }

    app/views/admin/application_settings/_snowplow.html.haml:10

    --       = html_escape(_('Configure %{link} to track events. %{link_start}Learn more.%{link_end}')) % { link: link_to('Snowplow', 'https://snowplowanalytics.com/', target: '_blank').html_safe, link_start: link_start, link_end: '</a>'.html_safe }
    ++       = html_escape(_('Configure %{link} to track events. %{link_start}Learn more.%{link_end}')) % { link: link_to('Snowplow', 'https://snowplowanalytics.com/', target: '_blank', rel: 'noopener noreferrer').html_safe, link_start: link_start, link_end: '</a>'.html_safe }
  4. Verify that the links for Mailgun and Snowplow now have rel="noopener noreferrer". 🎉

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Greg Myers

Merge request reports