BUHH

[ghost]

😠

[HelloZeroNet]

Please open a new issue with the details if you found any security problem.

[ghost]

I'm gonna take a wild guess and say that he's talking about line 281 in his pr @HelloZeroNet

[ghost]

[HelloZeroNet]

The no-referrer header does not fixes the linked issue.
To avoid tabnabbing we would need to add noopener rel to the links, but as far as I know there is no way to do it by http headers.

[ghost]

@HelloZeroNet https://cheatsheetseries.owasp.org/cheatsheets/HTML5_Security_Cheat_Sheet.html#tabnabbing

Also, we have the wrapperOpenWindow zeroframe cmd that we need to do this for.

[HelloZeroNet]

The wrapperOpenWindow already work like this:
https://github.com/HelloZeroNet/ZeroNet/blob/py3/src/Ui/media/Wrapper.coffee#L235

[ghost]

Ok, I didn't know that. Good!

[ghost]

The wrapperOpenWindow already work like this:
https://github.com/HelloZeroNet/ZeroNet/blob/py3/src/Ui/media/Wrapper.coffee#L235

Sending the header is better!