Tabnabbing vulnerability in snow theme

[jonathanlloyd]

Steps for Reproduction

1. Visit https://quilljs.com/standalone/snow/
2. Create a link to some url
3. Click the link to get the link preview
4. Inspect the link element

Expected behavior:
The link has the target attribute set to _blank but has no rel property. This means that documents containing untrusted links make the page they are embedded in susceptible to tabnabbing https://www.owasp.org/index.php/Reverse_Tabnabbing.

It would be expected that the rel property be set to noopener (possibly also norefferer and nofollow)

Actual behavior:
No rel property is set

Platforms:
All
Include browser, operating system and respective versions

Version:
All
Run Quill.version to find out

[jonathanlloyd]

The issue is in quill/themes/snow.js line 72-77:

SnowTooltip.TEMPLATE = [
  '<a class="ql-preview" target="_blank" href="about:blank"></a>',
  '<input type="text" data-formula="e=mc^2" data-link="https://quilljs.com" data-video="Embed URL">',
  '<a class="ql-action"></a>',
  '<a class="ql-remove"></a>',
].join('');

[d4l-w4r]

Hey @jhchen !
I just stumbled over this vulnerability while auditing our app.
The fix is merged but there doesn't seem to have been a deployment since then.

Do you have any timeline to release a bugfix version soon? Or could you create a new patch tag 1.3.7 at the mitigating commit (aceaf9f) and release a patch update?

As it is right now, this issue probably shouldn't be closed because it still requires action by the maintainer before the vulnerability is actually fixed for users.

[d4l-w4r]

Hi!
I found that Jonathans fix does not completely protect quill users from tabnabbing.
I have added PR #2674 to add the rel="noopener noreferrer" attribute to anchor tags created by formats/link.js

[judaproteam]

The issue is in quill/themes/snow.js line 72-77:

SnowTooltip.TEMPLATE = [
  '<a class="ql-preview" target="_blank" href="about:blank"></a>',
  '<input type="text" data-formula="e=mc^2" data-link="https://quilljs.com" data-video="Embed URL">',
  '<a class="ql-action"></a>',
  '<a class="ql-remove"></a>',
].join('');

why can i you just add to the code rel='noopene norefferer nofollow'
like this

<a class="ql-preview" target="_blank" href="about:blank" rel='noopene norefferer nofollow'></a>

i actuly try that, but it didnt change anything, why is that?

[d4l-w4r]

<a class="ql-preview" target="_blank" href="about:blank" rel='noopene norefferer nofollow'></a>

i actuly try that, but it didnt change anything, why is that?

This was a long time ago and I'm not sure if that TEMPLATE variable is the correct place to put the fix...but assuming it is, and that this is the exact code you wrote, then it's because of 2 typos:

1. Your 'noopene' is missing an 'r'
2. 'norefferer' is misspelled. It should be 'noreferrer'

So your code should look like this:
<a class="ql-preview" target="_blank" href="about:blank" rel='noopener noreferrer nofollow'></a>