From 0873f4bb38efa8224cc8841c12c64068d637ba75 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Sep 06 2016 08:36:08 +0000
Subject: Specify rel="noopener noreferrer" to link including target='_blank'


This avoids potential security risk:
https://dev.to/ben/the-targetblank-vulnerability-by-example
https://mathiasbynens.github.io/rel-noopener/

---

diff --git a/pagure/templates/_render_repo.html b/pagure/templates/_render_repo.html
index 231a2fb..38df7e8 100644
--- a/pagure/templates/_render_repo.html
+++ b/pagure/templates/_render_repo.html
@@ -255,8 +255,10 @@
       Contributions <a href="{{config.get('DATAGREPPER_URL')}}/raw?category={{config.get('DATAGREPPER_CATEGORY', 'pagure')}}&user={{username}}" class="btn btn-secondary btn-sm pull-xs-right">View List</a>
     </div>
     <div class="card-block p-a-0">
-      <a href="{{config.get('DATAGREPPER_URL')}}/charts/line?category={{config.get('DATAGREPPER_CATEGORY', 'pagure')}}&user={{username}}&split_on=users&delta=31536000&N=12&title=&show_y_labels=False&width=700&height=200&style=light_solarized" target="_blank">
-        <img src="{{config.get('DATAGREPPER_URL')}}/charts/line?category={{config.get('DATAGREPPER_CATEGORY', 'pagure')}}&user={{username}}&split_on=users&delta=31536000&N=12&title=&show_y_labels=False&width=400&height=200&style=light_solarized" alt="User activity graph"/>
+      <a href="{{config.get('DATAGREPPER_URL')}}/charts/line?category={{config.get('DATAGREPPER_CATEGORY', 'pagure')}}&user={{username}}&split_on=users&delta=31536000&N=12&title=&show_y_labels=False&width=700&height=200&style=light_solarized"
+        target="_blank" rel="noopener noreferrer">
+        <img src="{{config.get('DATAGREPPER_URL')}}/charts/line?category={{config.get('DATAGREPPER_CATEGORY', 'pagure')}}&user={{username}}&split_on=users&delta=31536000&N=12&title=&show_y_labels=False&width=400&height=200&style=light_solarized"
+          alt="User activity graph"/>
       </a>
     </div>
   </div>
diff --git a/pagure/templates/issue.html b/pagure/templates/issue.html
index 997a59c..ff46a70 100644
--- a/pagure/templates/issue.html
+++ b/pagure/templates/issue.html
@@ -89,7 +89,7 @@
             </div>
           </fieldset>
           <a href="http://daringfireball.net/projects/markdown/syntax"
-             target="_blank">Markdown Syntax</a>
+             target="_blank" rel="noopener noreferrer">Markdown Syntax</a>
           <div>
             <input type="submit" class="btn btn-primary"
               value="Update Issue" tabindex=2 />
diff --git a/pagure/templates/new_issue.html b/pagure/templates/new_issue.html
index 642019b..32a0d09 100644
--- a/pagure/templates/new_issue.html
+++ b/pagure/templates/new_issue.html
@@ -91,7 +91,7 @@
           <input type="button" value="Cancel" class="btn btn-secondary" onclick="history.back();">
           {{ form.csrf_token }}
           <a href="http://daringfireball.net/projects/markdown/syntax"
-            target="_blank">Markdown Syntax</a>
+            target="_blank" rel="noopener noreferrer">Markdown Syntax</a>
         </p>
       </form>
       </div>
diff --git a/pagure/templates/pull_request.html b/pagure/templates/pull_request.html
index 531cb8a..f11cb8f 100644
--- a/pagure/templates/pull_request.html
+++ b/pagure/templates/pull_request.html
@@ -541,7 +541,7 @@
               </fieldset>
 
               <a href="http://daringfireball.net/projects/markdown/syntax"
-                 target="_blank">Markdown Syntax</a>
+                 target="_blank" rel="noopener noreferrer">Markdown Syntax</a>
               <div>
                 <input type="submit" class="btn btn-primary"
                   value="Update Issue" tabindex=2 />
diff --git a/pagure/templates/repo_master.html b/pagure/templates/repo_master.html
index 1fa75be..de13543 100644
--- a/pagure/templates/repo_master.html
+++ b/pagure/templates/repo_master.html
@@ -212,7 +212,7 @@
       <li class="nav-item pull-xs-right">
         <a class="nav-link" href="{{ config['DOC_APP_URL'] + url_for('.view_repo',
                 username=username, repo=repo.name, filename=filename)
-          }}" target="_blank" title="Open to a new tab">
+          }}" target="_blank" title="Open to a new tab" rel="noopener noreferrer">
           <span class="oi" data-glyph="external-link"></span>
         </a>
       </li>