Prevent reverse tabnapping in window.open

Rules and Languages New rules / language support
1

Hi

There is the rule Web:S5148 for HTML to set noopener attribute on links.
But I could not find a rule for javascript that does the same check for window.open() calls.
Have a look at
Reverse Tabnabbing Software Attack | OWASP Foundation and HTML5 Security - OWASP Cheat Sheet Series which recommend to use the correct flags on the window.open call.

Kind regards,
Michael

2

Hello @reitzmichnicht
thanks for this idea, indeed it will be a nice addition to the rule s5148
we created a ticket to support that sonarjs-2621

Eric

3

Thanks a lot, hopefully this will make it in the next updates.