marcel/familienarchiv
1
0
Fork 0
Code Issues 119 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

fix(document): add rel=noopener noreferrer to viewer download link (CWE-1022)

Browse Source 
The error-state download link opened with target="_blank" but no rel,
exposing the opener to reverse tabnavbabbing. Add rel="noopener
noreferrer". Same-origin so low severity, but a one-token fix in a file
this issue already touches.

Refs #708

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Marcel
2026-06-01 20:13:45 +02:00
parent e0eedc70f9
commit 6690e1374d
2 changed files with 15 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
frontend/src/lib/document/DocumentViewer.svelte
View File

@@ -72,6 +72,7 @@ let {
<a <a
href="/api/documents/{doc.id}/file" href="/api/documents/{doc.id}/file"
target="_blank" target="_blank"
rel="noopener noreferrer"
class="text-sm underline hover:text-white" class="text-sm underline hover:text-white"
> >
{m.doc_download_link()} {m.doc_download_link()}

14
frontend/src/lib/document/DocumentViewer.svelte.test.ts
View File

@@ -46,6 +46,20 @@ describe('DocumentViewer', () => {
.toHaveAttribute('href', '/api/documents/d1/file'); .toHaveAttribute('href', '/api/documents/d1/file');
}); });
it('hardens the target=_blank download link with rel=noopener noreferrer (CWE-1022)', async () => {
render(DocumentViewer, {
props: {
...baseProps,
doc: { ...baseProps.doc, filePath: 'docs/scan.pdf' },
error: 'Render failed'
}
});
await expect
.element(page.getByRole('link', { name: /direkter download/i }))
.toHaveAttribute('rel', 'noopener noreferrer');
});
it('omits the direct-download link in the error state when filePath is null', async () => { it('omits the direct-download link in the error state when filePath is null', async () => {
render(DocumentViewer, { props: { ...baseProps, error: 'Render failed' } }); render(DocumentViewer, { props: { ...baseProps, error: 'Render failed' } });