search

curationexperts / cypripedium

A Hyrax 3 application for the Federal Reserve Bank of Minneapolis
2 stars 3 forks source link

Address potential "tabnabbing" vulnerability #590

Closed mark-dce closed 4 weeks ago

mark-dce commented 4 weeks ago

ISSUE FRB Security Scans have identified links to external sites opened in new windows (i.e. target='_blank') as a potential security threat.

Examples of these links appear in the Research Database footer such as:

<a class="navbar-link" target="_blank" href="https://minneapolisfed.org">Minneapolis Fed Home</a>
<a class="navbar-link" target="_blank" href="https://minneapolisfed.org/site-information/disclaimer">Disclaimer</a>
<a class="navbar-link" target="_blank" href="https://minneapolisfed.org/site-information/privacy-policies">Privacy Policy</a>
<a href="https://www.minneapolisfed.org/economic-research" class="navbar-link" target="_blank">Federal Reserve Bank of Minneapolis Research Division</a>

For further details, see https://cwe.mitre.org/data/definitions/1022.html

REOLUTION Although all of these links are to other trusted FRBM sites, modern accessibilty practices discourage opening content in new pages since this can create a disorenting experience for users not expecting to move to a new window (e.g. the browser back function no longer works as expected).

We've chosen to eliminate the new window targets and simply open the page in the same browser window because:

  1. All modern browsers provide an easy mechanism that allows users to choose wether to open the link it the same window or a new window or tab, typically by using a modifier key when clicking the link.
  2. The links in question are relatively low use footer links, and pose minimal disruption to workflow if opened in the current window.

OTHER REFERENCES