fix: reverse tabnabbing vulnerability in URLs (#591)

istanbuljs · Dec 29, 2021 · 4eceb9e · 4eceb9e
1 parent 2d41da5
commit 4eceb9e
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 2 deletions.
diff --git a/packages/istanbul-reports/lib/html-spa/src/index.js b/packages/istanbul-reports/lib/html-spa/src/index.js
@@ -144,7 +144,11 @@ function App() {
             </div>
             <div className="layout__section center small quiet">
                 Code coverage generated by{' '}
-                <a href="https://istanbul.js.org/" target="_blank">
+                <a
+                    href="https://istanbul.js.org/"
+                    target="_blank"
+                    rel="noopener noreferrer"
+                >
                     istanbul
                 </a>{' '}
                 at {window.generatedDatetime}

diff --git a/packages/istanbul-reports/lib/html/index.js b/packages/istanbul-reports/lib/html/index.js
@@ -100,7 +100,7 @@ function footerTemplate(details) {
             </div><!-- /wrapper -->
             <div class='footer quiet pad2 space-top1 center small'>
                 Code coverage generated by
-                <a href="https://istanbul.js.org/" target="_blank" rel="noopener">istanbul</a>
+                <a href="https://istanbul.js.org/" target="_blank" rel="noopener noreferrer">istanbul</a>
                 at ${html.escape(details.datetime)}
             </div>
         <script src="${html.escape(details.prettify.js)}"></script>