javacatknight commented on PR #36386: URL: https://github.com/apache/superset/pull/36386#issuecomment-3610642778
> * [ ] [**Security Issue**](https://github.com/apache/superset/pull/36386/files#diff-e1517a6522079eb97ad8178733f3673686a006ccec654d3c68f2e338ccd7c58dR146-R199)External links use `target="_blank"` with `rel="noreferrer"` only. Without `noopener`, this can expose the page to reverse tabnabbing via `window.opener`. This applies both to the GitHub "Add your name/org!" link and the per-user/org links in the cards. For your interest! noreferrer now includes noopener - https://html.spec.whatwg.org/multipage/links.html#link-type-noreferrer -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
