So I learned something rather surprising today and it's pretty scary. I'm actually stunned neither Chrome/Google, nor Mozilla, have plugged it. First, the logistics of how I ran across this
- I linked to a page in chat (I want you to read this first so the link is at the end). Pretty benign site
- Someone in chat clicked the link later.
- That page then hijacked the chat window and redirected it
When a website uses
target="_blank"on their links in order to open a new tab or window, that website gives the new page access to the existing window through the
window.openerAPI, allowing it a few permissions. Some of these permissions are automatically negated by cross-domain restrictions, but window.location is fair game.
In order to restrict this behavior, the original page needs to add a
rel="noopener"attribute to any link that has
target="_blank". However, Firefox does not support that tag, so you should actually use
rel="noopener noreferrer"for full coverage. I am not sure why this behavior even exists as the default, but it does. This is an extremely common vulnerability. If you landed on this page, I encourage you to contact the developers of the referring website and alert them of this issue.
You don't have to take my word for it tho. Here's how you can reproduce it on demand
- Join any chat (chat links always open a new tab/window)
- Paste this URL in and submit: https://dev.to/rly
- Click the link in chat
- It opens the link in a new tab/window and your chat window is redirected to https://dev.to/phishing
Looks like an easy fix (SO links already add
rel="nofollow" for SEO purposes) but this needs fixing yesterday. Hat tip to Kyll for noting it does that.