All links should include rel="noopener noreferrer"

[tbarbugli]

Links are converted to HTML anchor tags.

For example doyensec.com is converted to doyensec.com. As no rel attribute is present, it is possible for the website opened in the new tab (i.e. doyensec.com) to redirect the opener tab (i.e. bevybevy.com) to an arbitrary location.

Reproduction Steps

1. Create an HTML file with the following content:
   <script>window.opener.location.href="https://doyensec.com";</script>
2. Host the HTML file on an HTTP server (i.e. http://attacker.com/exploit.html)
3. Send in a streaming chat the link to the HTML file (i.e. http://attacker.com/exploit.html)
4. Click on the link in the chat
5. Go back to the previous tab
6. Notice the tab has been redirected to https://doyensec.com

Remediation
Add the rel="noopener" attribute to anchor tags. This attribute prevents "child" tabs to access the window.opener object.

Resources
• https://owasp.org/www-community/attacks/Reverse_Tabnabbing
• https://developer.mozilla.org/en-US/docs/Web/HTML/Link_types/noopener

gz#6585