From 6560604d83fad47da22f3cfda05ca0d74a1ec756 Mon Sep 17 00:00:00 2001
From: Anirudh Sai Mergu <AnirudhMergu@users.noreply.github.com>
Date: Wed, 30 Dec 2020 16:13:54 +0530
Subject: [PATCH 1/3] Fix Reverse Tabnabbing vulnerability in the URL

Tabnabbing - "it's the capacity to act on parent page's content or location from a newly opened page via the back link exposed by the opener javascript object instance."

This vulnerability usually manifests when either

The "target" attribute is used to specify the target location in an anchor <a> tag to open 3rd party URL/resource(s) without including the attribute rel="noopener,noreferrer " in the anchor <a> tag

noopener - When noopener is set, the child window opened will not have access to the parent window via "Window.opener" and at the same time, the parent window will not have access to the child window. "Note that when noopener is used, nonempty target names other than _top, _self, and _parent are all treated like _blank in terms of deciding whether to open a new window/tab."

noreferrer - When noreferrer is set, the child window opened will not have access to parent URL. "In addition, setting this feature also automatically sets noopener."

NOTE: - Though "noreferrer" also enforces "noopener", it is recommended to set both the options to maximize proper remediation of tabnabbing regardless of the browser type used by the customer.
---
 packages/istanbul-reports/lib/html-spa/src/index.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/istanbul-reports/lib/html-spa/src/index.js b/packages/istanbul-reports/lib/html-spa/src/index.js
index e8fd1458..9a46eb16 100644
--- a/packages/istanbul-reports/lib/html-spa/src/index.js
+++ b/packages/istanbul-reports/lib/html-spa/src/index.js
@@ -144,7 +144,7 @@ function App() {
             </div>
             <div className="layout__section center small quiet">
                 Code coverage generated by{' '}
-                <a href="https://istanbul.js.org/" target="_blank">
+                <a href="https://istanbul.js.org/" target="_blank" rel="noopener noreferrer">
                     istanbul
                 </a>{' '}
                 at {window.generatedDatetime}

From 3588ebd9055c90371344605720fd2780a7c671d3 Mon Sep 17 00:00:00 2001
From: Anirudh Sai Mergu <AnirudhMergu@users.noreply.github.com>
Date: Wed, 30 Dec 2020 16:17:52 +0530
Subject: [PATCH 2/3] Fix Reverse Tabnabbing issue in the URLs.

Tabnabbing - "it's the capacity to act on parent page's content or location from a newly opened page via the back link exposed by the opener javascript object instance."

This vulnerability usually manifests when either

The "target" attribute is used to specify the target location in an anchor <a> tag to open 3rd party URL/resource(s) without including the attribute rel="noopener,noreferrer " in the anchor <a> tag

noopener - When noopener is set, the child window opened will not have access to the parent window via "Window.opener" and at the same time, the parent window will not have access to the child window. "Note that when noopener is used, nonempty target names other than _top, _self, and _parent are all treated like _blank in terms of deciding whether to open a new window/tab."

noreferrer - When noreferrer is set, the child window opened will not have access to parent URL. "In addition, setting this feature also automatically sets noopener."

NOTE: - Though "noreferrer" also enforces "noopener", it is recommended to set both the options to maximize proper remediation of tabnabbing regardless of the browser type used by the customer.
---
 packages/istanbul-reports/lib/html/index.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/istanbul-reports/lib/html/index.js b/packages/istanbul-reports/lib/html/index.js
index 8b2e4200..e4728305 100644
--- a/packages/istanbul-reports/lib/html/index.js
+++ b/packages/istanbul-reports/lib/html/index.js
@@ -94,7 +94,7 @@ function footerTemplate(details) {
             </div><!-- /wrapper -->
             <div class='footer quiet pad2 space-top1 center small'>
                 Code coverage generated by
-                <a href="https://istanbul.js.org/" target="_blank">istanbul</a>
+                <a href="https://istanbul.js.org/" target="_blank" rel="noopener noreferrer">istanbul</a>
                 at ${html.escape(details.datetime)}
             </div>
         </div>

From e15783d3bbffcbab353ede2e233f3f516acfa0a7 Mon Sep 17 00:00:00 2001
From: "bencoe@google.com" <bencoe@google.com>
Date: Wed, 29 Dec 2021 20:52:07 +0000
Subject: [PATCH 3/3] chore: fix layout

---
 packages/istanbul-reports/lib/html-spa/src/index.js | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/packages/istanbul-reports/lib/html-spa/src/index.js b/packages/istanbul-reports/lib/html-spa/src/index.js
index 9a46eb16..c89c416e 100644
--- a/packages/istanbul-reports/lib/html-spa/src/index.js
+++ b/packages/istanbul-reports/lib/html-spa/src/index.js
@@ -144,7 +144,11 @@ function App() {
             </div>
             <div className="layout__section center small quiet">
                 Code coverage generated by{' '}
-                <a href="https://istanbul.js.org/" target="_blank" rel="noopener noreferrer">
+                <a
+                    href="https://istanbul.js.org/"
+                    target="_blank"
+                    rel="noopener noreferrer"
+                >
                     istanbul
                 </a>{' '}
                 at {window.generatedDatetime}