zappycode / zappycode-django

The code behind ZappyCode.com 💻 Come check it out and see how it ticks!
51 stars 41 forks source link

Security Issue: Cross Origin Destinations #49

Closed brian101co closed 3 years ago

brian101co commented 4 years ago

A security improvement for zappycode would be adding rel="noopener" to the navigation links Code and Analytics. This allows the external site to not access zappycodes javascript window object. This may allow the other page to redirect your page to a malicious URL.

The other page may run on the same process as your page. If the other page is running a lot of JavaScript, zappycodes performance may suffer.