Open
Description
What happened?
Unsafe Use of Target blank , In the application, when opening a new page using an HTML element with the "target"
attribute (with any value), or with window.open() within JavaScript, the new page has some access to the original page through the window.opener object. This may allow redirection to a malicious phishing page.
What did you expect to happen?
When invoking an untrusted new window using "var newWindow = window.open()", set "newWindow.opener=null" before setting "newWindow.location" to a potentially untrusted site, such that when the new site is open in the new window, it has no access to its original "opener" attribute.
Reproduction URL
https://jsfiddle.net/rstoenescu/a2cuzods
How to reproduce?
- Go to the provided URL.
- Open the CDN url of Quasar (https://cdn.jsdelivr.net/npm/quasar@2/dist/quasar.umd.prod.js).
Search for "window.open()" in the file content.
Flavour
UMD
Areas
SPA Mode
Platforms/Browsers
Chrome
Quasar info output
Relevant log output
Additional context
No response