diff --git a/src/compiler/compile/nodes/Element.ts b/src/compiler/compile/nodes/Element.ts index 06ef1ba9c1a9..0d3e8a01bd44 100644 --- a/src/compiler/compile/nodes/Element.ts +++ b/src/compiler/compile/nodes/Element.ts @@ -621,22 +621,23 @@ export default class Element extends Node { const name_attribute = attribute_map.get('name'); const target_attribute = attribute_map.get('target'); - if (target_attribute && target_attribute.get_static_value() === '_blank' && href_attribute) { + // links with target="_blank" should have noopener or noreferrer: https://developer.chrome.com/docs/lighthouse/best-practices/external-anchors-use-rel-noopener/ + // modern browsers add noopener by default, so we only need to check legacy browsers + // legacy browsers don't support noopener so we only check for noreferrer there + if (component.compile_options.legacy && target_attribute && target_attribute.get_static_value() === '_blank' && href_attribute) { const href_static_value = href_attribute.get_static_value() ? href_attribute.get_static_value().toLowerCase() : null; if (href_static_value === null || href_static_value.match(/^(https?:)?\/\//i)) { const rel = attribute_map.get('rel'); if (rel == null || rel.is_static) { const rel_values = rel ? rel.get_static_value().split(regex_any_repeated_whitespaces) : []; - const expected_values = ['noreferrer']; - expected_values.forEach(expected_value => { - if (!rel || rel && rel_values.indexOf(expected_value) < 0) { + if (!rel || !rel_values.includes('noreferrer')) { component.warn(this, { - code: `security-anchor-rel-${expected_value}`, - message: `Security: Anchor with "target=_blank" should have rel attribute containing the value "${expected_value}"` + code: 'security-anchor-rel-noreferrer', + message: + 'Security: Anchor with "target=_blank" should have rel attribute containing the value "noreferrer"' }); - } - }); + } } } } diff --git a/test/validator/samples/security-anchor-rel-noreferer-legacy/_config.js b/test/validator/samples/security-anchor-rel-noreferer-legacy/_config.js new file mode 100644 index 000000000000..52f59c8767d5 --- /dev/null +++ b/test/validator/samples/security-anchor-rel-noreferer-legacy/_config.js @@ -0,0 +1,3 @@ +export default { + legacy: true +}; diff --git a/test/validator/samples/security-anchor-rel-noreferrer/input.svelte b/test/validator/samples/security-anchor-rel-noreferer-legacy/input.svelte similarity index 100% rename from test/validator/samples/security-anchor-rel-noreferrer/input.svelte rename to test/validator/samples/security-anchor-rel-noreferer-legacy/input.svelte diff --git a/test/validator/samples/security-anchor-rel-noreferrer/warnings.json b/test/validator/samples/security-anchor-rel-noreferer-legacy/warnings.json similarity index 100% rename from test/validator/samples/security-anchor-rel-noreferrer/warnings.json rename to test/validator/samples/security-anchor-rel-noreferer-legacy/warnings.json diff --git a/test/validator/samples/security-anchor-rel-noreferer/input.svelte b/test/validator/samples/security-anchor-rel-noreferer/input.svelte new file mode 100644 index 000000000000..f5361e5cfeaa --- /dev/null +++ b/test/validator/samples/security-anchor-rel-noreferer/input.svelte @@ -0,0 +1,33 @@ +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +Same host (valid) +Same host (valid) +Same host (valid) +svelte website (valid) +svelte website (valid) +svelte website (valid) +svelte website (valid) +svelte website (valid) +svelte website (valid) +svelte website (valid) +svelte website (valid) +svelte website (valid) +svelte website (valid) + +svelte website (valid) diff --git a/test/validator/samples/security-anchor-rel-noreferer/warnings.json b/test/validator/samples/security-anchor-rel-noreferer/warnings.json new file mode 100644 index 000000000000..fe51488c7066 --- /dev/null +++ b/test/validator/samples/security-anchor-rel-noreferer/warnings.json @@ -0,0 +1 @@ +[]