From 4eceb9eb8b3169b882d74ecc526fb5837ebc6205 Mon Sep 17 00:00:00 2001
From: Anirudh Mergu <AnirudhMergu@users.noreply.github.com>
Date: Thu, 30 Dec 2021 03:07:16 +0530
Subject: [PATCH] fix: reverse tabnabbing vulnerability in URLs (#591)

---
 packages/istanbul-reports/lib/html-spa/src/index.js | 6 +++++-
 packages/istanbul-reports/lib/html/index.js         | 2 +-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/packages/istanbul-reports/lib/html-spa/src/index.js b/packages/istanbul-reports/lib/html-spa/src/index.js
index e8fd1458..c89c416e 100644
--- a/packages/istanbul-reports/lib/html-spa/src/index.js
+++ b/packages/istanbul-reports/lib/html-spa/src/index.js
@@ -144,7 +144,11 @@ function App() {
             </div>
             <div className="layout__section center small quiet">
                 Code coverage generated by{' '}
-                <a href="https://istanbul.js.org/" target="_blank">
+                <a
+                    href="https://istanbul.js.org/"
+                    target="_blank"
+                    rel="noopener noreferrer"
+                >
                     istanbul
                 </a>{' '}
                 at {window.generatedDatetime}
diff --git a/packages/istanbul-reports/lib/html/index.js b/packages/istanbul-reports/lib/html/index.js
index 968f8e3a..0c279b90 100644
--- a/packages/istanbul-reports/lib/html/index.js
+++ b/packages/istanbul-reports/lib/html/index.js
@@ -100,7 +100,7 @@ function footerTemplate(details) {
             </div><!-- /wrapper -->
             <div class='footer quiet pad2 space-top1 center small'>
                 Code coverage generated by
-                <a href="https://istanbul.js.org/" target="_blank" rel="noopener">istanbul</a>
+                <a href="https://istanbul.js.org/" target="_blank" rel="noopener noreferrer">istanbul</a>
                 at ${html.escape(details.datetime)}
             </div>
         <script src="${html.escape(details.prettify.js)}"></script>