From 4cc2c44678b2a0279e798ec95cf1093038699fc9 Mon Sep 17 00:00:00 2001 From: Higgs32584 Date: Tue, 27 Oct 2026 00:39:40 -0400 Subject: [PATCH] Security: web links open with noopener as a window feature, not in the window name (#2715) window.open(url, "_blank,noopener") named the new window "_blank,noopener" and passed no features, so a page opened from a workbook link kept window.opener and could navigate the editor tab. Pass "noopener,noreferrer" as the features argument instead. Co-Authored-By: Claude Opus 5.5 --- apps/gridcraft-web/src/web.rs | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/apps/gridcraft-web/src/web.rs b/apps/gridcraft-web/src/web.rs index 43923bde1..10e17dc44 100644 --- a/apps/gridcraft-web/src/web.rs +++ b/apps/gridcraft-web/src/web.rs @@ -230,8 +230,9 @@ fn services(inbox: Inbox, ctx: egui::Context) -> Services { && let gridcraft_engine::links::LinkKind::External(url) = gridcraft_engine::links::classify(url) { // With `noopener` the new browsing context can't hold a reference back to the - // editor window and navigate it while the user reads the linked page. - let _ = w.open_with_url_and_target(&url, "_blank,noopener"); + // editor window and navigate it while the user reads the linked page. It must be a + // window *feature*: inside the target string it would only name the new window. + let _ = w.open_with_url_and_target_and_features(&url, "_blank", "noopener,noreferrer"); } })), inbox: Some(inbox),