Use noreferrer for window.open (#1365)

josdejong · Aug 25, 2021 · ed09d87 · ed09d87
1 parent a0f69af
commit ed09d87
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/src/js/Node.js b/src/js/Node.js
@@ -2581,7 +2581,7 @@ export class Node {
             // if read-only, we use the regular click behavior of an anchor
             if (isUrl(this.value)) {
               event.preventDefault()
-              window.open(this.value, '_blank', 'noopener')
+              window.open(this.value, '_blank', 'noreferrer')
             }
           }
           break
@@ -2749,7 +2749,7 @@ export class Node {
       if (target === this.dom.value) {
         if (!this.editable.value || event.ctrlKey) {
           if (isUrl(this.value)) {
-            window.open(this.value, '_blank', 'noopener')
+            window.open(this.value, '_blank', 'noreferrer')
             handled = true
           }
         }

diff --git a/src/js/textmode.js b/src/js/textmode.js
@@ -244,7 +244,7 @@ textmode.create = function (container, options = {}) {
         // TODO: this anchor falls below the margin of the content,
         // therefore the normal a.href does not work. We use a click event
         // for now, but this should be fixed.
-        window.open(poweredBy.href, poweredBy.target, 'noopener')
+        window.open(poweredBy.href, poweredBy.target, 'noreferrer')
       }
       this.menu.appendChild(poweredBy)
     }