Invicti: Preventing window.opener phishing vulnerability (#4007)

GSA-TTS · Jun 25, 2024 · b247887 · b247887
1 parent d5e305b
commit b247887
Showing 1 changed file with 18 additions and 9 deletions.
diff --git a/backend/templates/includes/nav_primary.html b/backend/templates/includes/nav_primary.html
@@ -39,15 +39,18 @@
                             </li>
                             <li class="usa-nav__submenu-item">
                                 <a href="{{ STATIC_SITE_URL }}search-resources/"
-                                   target="_blank">Search resources</a>
+                                   target="_blank"
+                                   rel="noopener noreferrer">Search resources</a>
                             </li>
                             <li class="usa-nav__submenu-item">
                                 <a href="{{ STATIC_SITE_URL }}api/"
-                                target="_blank">Developer resources</a>
+                                target="_blank"
+                                rel="noopener noreferrer">Developer resources</a>
                             </li>
                             <li class="usa-nav__submenu-item">
                                 <a href="{{ STATIC_SITE_URL }}search-resources/tribal/"
-                                target="_blank">Tribal audits</a>
+                                target="_blank"
+                                rel="noopener noreferrer">Tribal audits</a>
                             </li>
                         </ul>
                     </li>
@@ -61,7 +64,8 @@
                         <ul id="basic-nav-submission" class="usa-nav__submenu">
                             <li class="usa-nav__submenu-item">
                                 <a href="{{ STATIC_SITE_URL }}audit-resources/"
-                                   target="_blank">Submission resources</a>
+                                   target="_blank"
+                                   rel="noopener noreferrer">Submission resources</a>
                             </li>
                             <li class="usa-nav__submenu-item">
                                 <a href="{% url 'audit:MySubmissions' %}">
@@ -80,11 +84,13 @@
                         <ul id="basic-nav-updates" class="usa-nav__submenu">
                             <li class="usa-nav__submenu-item">
                                 <a href="{{ STATIC_SITE_URL }}updates/"
-                                   target="_blank">FAC updates</a>
+                                   target="_blank"
+                                   rel="noopener noreferrer">FAC updates</a>
                             </li>
                             <li class="usa-nav__submenu-item">
                                 <a href="{{ STATIC_SITE_URL }}omb/"
-                                   target="_blank">OMB announcements</a>
+                                   target="_blank"
+                                   rel="noopener noreferrer">OMB announcements</a>
                             </li>
                         </ul>
                     </li>
@@ -98,15 +104,18 @@
                         <ul id="basic-nav-policy" class="usa-nav__submenu">
                             <li class="usa-nav__submenu-item">
                                 <a href="{{ STATIC_SITE_URL }}compliance/"
-                                   target="_blank">Compliance</a>
+                                   target="_blank"
+                                   rel="noopener noreferrer">Compliance</a>
                             </li>
                             <li class="usa-nav__submenu-item">
                                 <a href="{{ STATIC_SITE_URL }}uniform-guidance/"
-                                   target="_blank">Uniform guidance</a>
+                                   target="_blank"
+                                   rel="noopener noreferrer">Uniform guidance</a>
                             </li>
                             <li class="usa-nav__submenu-item">
                                 <a href="{{ STATIC_SITE_URL }}audit-resources/burden-statement/"
-                                   target="_blank">Burden statement</a>
+                                   target="_blank"
+                                   rel="noopener noreferrer">Burden statement</a>
                             </li>
                         </ul>
                     </li>