fix: anchor tag safety

Setting target="_blank" on anchor tags is unsafe unless used in
conjunction with rel="noopener".

This is a back-port of dd3afdc (#4789) to fix the problem in
version 2.x.

Signed-off-by: Miroslav Bajtoš <[email protected]>

Author: bajtos

src/main/template/main.handlebars

@@ -6,11 +6,11 @@
   <p>{{{sanitize externalDocs.description}}}</p>
   <a href="{{{escape externalDocs.url}}}" target="_blank">{{{escape externalDocs.url}}}</a>
   {{/if}}
-  {{#if info.termsOfServiceUrl}}<div class="info_tos"><a target="_blank" href="{{{escape info.termsOfServiceUrl}}}" data-sw-translate>Terms of service</a></div>{{/if}}
+  {{#if info.termsOfServiceUrl}}<div class="info_tos"><a target="_blank" rel="noopener noreferrer" href="{{{escape info.termsOfServiceUrl}}}" data-sw-translate>Terms of service</a></div>{{/if}}
   {{#if info.contact.name}}<div><div class='info_name' style="display: inline" data-sw-translate>Created by </div> {{{escape info.contact.name}}}</div>{{/if}}
-  {{#if info.contact.url}}<div class='info_url' data-sw-translate>See more at <a href="{{{escape info.contact.url}}}">{{{escape info.contact.url}}}</a></div>{{/if}}
+  {{#if info.contact.url}}<div class='info_url' data-sw-translate>See more at <a target="_blank" rel="noopener noreferrer" href="{{{escape info.contact.url}}}">{{{escape info.contact.url}}}</a></div>{{/if}}
   {{#if info.contact.email}}<div class='info_email'><a target="_parent" href="mailto:{{{escape info.contact.email}}}?subject={{{escape info.title}}}" data-sw-translate>Contact the developer</a></div>{{/if}}
-  {{#if info.license}}<div class='info_license'><a target="_blank" href='{{{escape info.license.url}}}'>{{{escape info.license.name}}}</a></div>{{/if}}
+  {{#if info.license}}<div class='info_license'><a target="_blank" rel="noopener noreferrer" href='{{{escape info.license.url}}}'>{{{escape info.license.name}}}</a></div>{{/if}}
   {{/if}}
 </div>
 <div class='container' id='resources_container'>
@@ -24,7 +24,7 @@
   , <span style="font-variant: small-caps" data-sw-translate>api version</span>: {{{escape info.version}}}
     {{/if}}]
     {{#if validatorUrl}}
-    <span style="float:right"><a target="_blank" href="{{{escape validatorUrl}}}/debug?url={{{escape url}}}"><img id="validator" src="{{{escape validatorUrl}}}?url={{{escape url}}}"></a>
+    <span style="float:right"><a target="_blank" rel="noopener noreferrer" href="{{{escape validatorUrl}}}/debug?url={{{escape url}}}"><img id="validator" src="{{{escape validatorUrl}}}?url={{{escape url}}}"></a>
     </span>
     {{/if}}
     </h4>

src/main/template/templates.js

@@ -141,13 +141,13 @@ templates['main'] = template({"1":function(container,depth0,helpers,partials,dat
     + ((stack1 = (helpers.sanitize || (depth0 && depth0.sanitize) || alias2).call(alias1,((stack1 = (depth0 != null ? depth0.externalDocs : depth0)) != null ? stack1.description : stack1),{"name":"sanitize","hash":{},"data":data})) != null ? stack1 : "")
     + "</p>\n  <a href=\""
     + ((stack1 = (helpers.escape || (depth0 && depth0.escape) || alias2).call(alias1,((stack1 = (depth0 != null ? depth0.externalDocs : depth0)) != null ? stack1.url : stack1),{"name":"escape","hash":{},"data":data})) != null ? stack1 : "")
-    + "\" target=\"_blank\">"
+    + "\" target=\"_blank\" rel=\"noopener noreferrer\">"
     + ((stack1 = (helpers.escape || (depth0 && depth0.escape) || alias2).call(alias1,((stack1 = (depth0 != null ? depth0.externalDocs : depth0)) != null ? stack1.url : stack1),{"name":"escape","hash":{},"data":data})) != null ? stack1 : "")
     + "</a>\n";
 },"4":function(container,depth0,helpers,partials,data) {
     var stack1;
 
-  return "<div class=\"info_tos\"><a target=\"_blank\" href=\""
+  return "<div class=\"info_tos\"><a target=\"_blank\" rel=\"noopener noreferrer\" href=\""
     + ((stack1 = (helpers.escape || (depth0 && depth0.escape) || helpers.helperMissing).call(depth0 != null ? depth0 : {},((stack1 = (depth0 != null ? depth0.info : depth0)) != null ? stack1.termsOfServiceUrl : stack1),{"name":"escape","hash":{},"data":data})) != null ? stack1 : "")
     + "\" data-sw-translate>Terms of service</a></div>";
 },"6":function(container,depth0,helpers,partials,data) {
@@ -159,7 +159,7 @@ templates['main'] = template({"1":function(container,depth0,helpers,partials,dat
 },"8":function(container,depth0,helpers,partials,data) {
     var stack1, alias1=depth0 != null ? depth0 : {}, alias2=helpers.helperMissing;
 
-  return "<div class='info_url' data-sw-translate>See more at <a href=\""
+  return "<div class='info_url' data-sw-translate>See more at <a target=\"_blank\" rel=\"noopener noreferrer\" href=\""
     + ((stack1 = (helpers.escape || (depth0 && depth0.escape) || alias2).call(alias1,((stack1 = ((stack1 = (depth0 != null ? depth0.info : depth0)) != null ? stack1.contact : stack1)) != null ? stack1.url : stack1),{"name":"escape","hash":{},"data":data})) != null ? stack1 : "")
     + "\">"
     + ((stack1 = (helpers.escape || (depth0 && depth0.escape) || alias2).call(alias1,((stack1 = ((stack1 = (depth0 != null ? depth0.info : depth0)) != null ? stack1.contact : stack1)) != null ? stack1.url : stack1),{"name":"escape","hash":{},"data":data})) != null ? stack1 : "")
@@ -175,7 +175,7 @@ templates['main'] = template({"1":function(container,depth0,helpers,partials,dat
 },"12":function(container,depth0,helpers,partials,data) {
     var stack1, alias1=depth0 != null ? depth0 : {}, alias2=helpers.helperMissing;
 
-  return "<div class='info_license'><a target=\"_blank\" href='"
+  return "<div class='info_license'><a target=\"_blank\" rel=\"noopener noreferrer\" href='"
     + ((stack1 = (helpers.escape || (depth0 && depth0.escape) || alias2).call(alias1,((stack1 = ((stack1 = (depth0 != null ? depth0.info : depth0)) != null ? stack1.license : stack1)) != null ? stack1.url : stack1),{"name":"escape","hash":{},"data":data})) != null ? stack1 : "")
     + "'>"
     + ((stack1 = (helpers.escape || (depth0 && depth0.escape) || alias2).call(alias1,((stack1 = ((stack1 = (depth0 != null ? depth0.info : depth0)) != null ? stack1.license : stack1)) != null ? stack1.name : stack1),{"name":"escape","hash":{},"data":data})) != null ? stack1 : "")
@@ -189,7 +189,7 @@ templates['main'] = template({"1":function(container,depth0,helpers,partials,dat
 },"16":function(container,depth0,helpers,partials,data) {
     var stack1, alias1=depth0 != null ? depth0 : {}, alias2=helpers.helperMissing;
 
-  return "    <span style=\"float:right\"><a target=\"_blank\" href=\""
+  return "    <span style=\"float:right\"><a target=\"_blank\" rel=\"noopener noreferrer\" href=\""
     + ((stack1 = (helpers.escape || (depth0 && depth0.escape) || alias2).call(alias1,(depth0 != null ? depth0.validatorUrl : depth0),{"name":"escape","hash":{},"data":data})) != null ? stack1 : "")
     + "/debug?url="
     + ((stack1 = (helpers.escape || (depth0 && depth0.escape) || alias2).call(alias1,(depth0 != null ? depth0.url : depth0),{"name":"escape","hash":{},"data":data})) != null ? stack1 : "")