Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix tabnabbing vulnerability in Snow theme #2439

Merged
merged 2 commits into from
Dec 28, 2018

Conversation

jonathanlloyd
Copy link
Contributor

@jonathanlloyd jonathanlloyd commented Dec 21, 2018

Fixes #2438

The link has the target attribute set to _blank but has no rel property. This means that documents containing untrusted links make the page they are embedded in susceptible to tabnabbing https://www.owasp.org/index.php/Reverse_Tabnabbing.
This PR sets the rel property to noopener (also norefferer and nofollow)

themes/snow.js Outdated
@@ -70,7 +70,7 @@ class SnowTooltip extends BaseTooltip {
}
}
SnowTooltip.TEMPLATE = [
'<a class="ql-preview" target="_blank" href="about:blank"></a>',
'<a class="ql-preview" rel="noopener noreferrer nofollow" target="_blank" href="about:blank"></a>',
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nofollow does not seem relevant to tabnabbing?

Copy link
Contributor Author

@jonathanlloyd jonathanlloyd Dec 28, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fair, noopener is sufficient to mitigate tabnabbing. I've left in noreferrer for privacy reasons but can remove that too if you think it's too much.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's fine these two are what React's linter suggests as well

@jhchen jhchen merged commit aceaf9f into slab:develop Dec 28, 2018
@jhchen
Copy link
Member

jhchen commented Dec 28, 2018

Thanks for the PR!

lsirivong pushed a commit to voxmedia/quill that referenced this pull request Sep 21, 2020
cdesch added a commit to cdesch/django-quill-editor that referenced this pull request Feb 5, 2021
Bump to Quill Version 1.3.7 - This version of Quill fixes Quill Vuln slab/quill#2438

Here is the change commit to fix the vuln in Quill slab/quill#2439

The Vuln is described here: https://ossindex.sonatype.org/vuln/d96c07dd-81f9-41f6-b2bd-531143bcaeab
LeeHanYeong pushed a commit to LeeHanYeong/django-quill-editor that referenced this pull request Feb 9, 2021
* Bump to Quill Version 1.3.7

Bump to Quill Version 1.3.7 - This version of Quill fixes Quill Vuln slab/quill#2438

Here is the change commit to fix the vuln in Quill slab/quill#2439

The Vuln is described here: https://ossindex.sonatype.org/vuln/d96c07dd-81f9-41f6-b2bd-531143bcaeab

* Adding JS/CSS include instructions from README.md

Resolves issue [#33](#33)
LeeHanYeong pushed a commit to LeeHanYeong/django-quill-editor that referenced this pull request Feb 27, 2021
…son_string' (#41)

* Bump to Quill Version 1.3.7

Bump to Quill Version 1.3.7 - This version of Quill fixes Quill Vuln slab/quill#2438

Here is the change commit to fix the vuln in Quill slab/quill#2439

The Vuln is described here: https://ossindex.sonatype.org/vuln/d96c07dd-81f9-41f6-b2bd-531143bcaeab

* Adding JS/CSS include instructions from README.md

Resolves issue [#33](#33)

* adding None return for json_string
LeeHanYeong pushed a commit to LeeHanYeong/django-quill-editor that referenced this pull request Dec 8, 2021
* Bump to Quill Version 1.3.7

Bump to Quill Version 1.3.7 - This version of Quill fixes Quill Vuln slab/quill#2438

Here is the change commit to fix the vuln in Quill slab/quill#2439

The Vuln is described here: https://ossindex.sonatype.org/vuln/d96c07dd-81f9-41f6-b2bd-531143bcaeab

* Adding JS/CSS include instructions from README.md

Resolves issue [#33](#33)
LeeHanYeong pushed a commit to LeeHanYeong/django-quill-editor that referenced this pull request Dec 8, 2021
…son_string' (#41)

* Bump to Quill Version 1.3.7

Bump to Quill Version 1.3.7 - This version of Quill fixes Quill Vuln slab/quill#2438

Here is the change commit to fix the vuln in Quill slab/quill#2439

The Vuln is described here: https://ossindex.sonatype.org/vuln/d96c07dd-81f9-41f6-b2bd-531143bcaeab

* Adding JS/CSS include instructions from README.md

Resolves issue [#33](#33)

* adding None return for json_string
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants