Link to github developer settings in auth provider setup doesn't open in a new tab

[nickwsuse]

Setup

• Rancher version: v2.7-head Commit ID:
• Rancher UI Extensions: N/A
• Browser type & version: Chrome Version 114.0.5735.198 (Official Build) (arm64)

Describe the bug
The link to https://github.com/settings/developers should be opening in a new tab, but is opening in the same tab when clicked. The text with the link suggests that it should - [Click here](https://github.com/settings/developers) to go to GitHub application settings in a new window.

To Reproduce

1. Create a Rancher instance on v2.7-head (or v2.7.3/v2.7.5)
2. Log into the Rancher instance
3. Click the hamburger menu in the upper left of the page
4. Click Users & Authentication
5. Click Auth Providers on the left side of the page
6. Click the Github OAuth option
7. See the link and text that suggests the link will open in a new tab/window
8. Click the link

Result
Clicking the link opens it in the same tab

Expected Result
Clicking the link opens it in a new tab

Screenshots

Additional context
I can repro this on v2.7.5 and on v2.7.3

[richard-cox]

Moving out of v2.7q3, given we've passed code freeze

[jonatan5524]

Hi, can I work on this issue?
I have tested this bug in a local environment and saw it also happen in the Google Authentication link

[jonatan5524]

After testing I saw that the t method returns the lins with target="_blank" but in HTML it is not presented (that is the attribute that opens the link in a new tab)
After changing the v-clean-html to v-html in this line:

dashboard/shell/edit/auth/github.vue

Line 191 in 7d8a223

<li v-clean-html="t(`authConfig.${NAME}.form.prefix.1`, tArgs, true)" />

The new tab link worked.
I saw v-html is Vue native but security advised not to use it, where did the v-clean-html come from?

[richard-cox]

Hi @jonatan5524 , thanks for taking a look at this issue. v-clean-html is shell/plugins/clean-html-directive.js which sanitises html input. It looks like the target attribute in intentionally stripped from the output. The team here will need to decide how best to handle this scenario

[jonatan5524]

Hi @jonatan5524 , thanks for taking a look at this issue. v-clean-html is shell/plugins/clean-html-directive.js which sanitises html input. It looks like the target attribute in intentionally stripped from the output. The team here will need to decide how best to handle this scenario

Thank you for the reply, If a desicion is made and need to make a change I will gladly take that 😊.

[richard-cox]

Reproducible in 2.8.2, but not in 2.9-head (2.9.0). Believe this to be fixed via #9920 was the fix