Rel noopener issue on window.open

[Taylor_Ackley]

Make sure to read this post before raising a thread here:

How to Report a False-positive / False-negative

Hey SonarSource Community! False-positives happen, as do false-negatives, and we’re eager to fix them. We are thrilled when our users report problems, so we can make our products better. What is a false-positive (FP)? A false-positive is when an issue is raised unexpectedly on code that should not trigger an issue, or where the suggested action doesn’t make any sense for the code. What is a false-negative (FN)? A false-negative is when an issue should be raised on a piece of code, but isn’t…

Then tell us:

• What language is this for? JavaScript
• Which rule? RSPEC-5148
• Why do you believe it’s a false-positive/false-negative? adding a windowFeatures string with noopener,noreferrer triggers the rule, even the MDN says that it’s valid. Additionally, setting the window.opener property to null as specified by the reference links in the rule info does not work either.
• Are you using
  • SonarCloud? Yes
  • SonarQube - which version?
  • SonarLint - which IDE/version?
    • in connected mode with SonarQube or SonarCloud?
• How can we reproduce the problem? Give us a self-contained snippet of code (formatted text, no screenshots)

    const target = window.open('https://sonarcloud.io', 'noopener,noreferrer');
    target.opener = null;

[eric.morand]

Dear @Taylor_Ackley , thanks a lot for your report.

Can you share with us the link to the MDN documentation that you mentioned?

Thanks in advance,

Eric.

[Taylor_Ackley]

Here is the MDN link where it says the features string should be csv for multiple values.

Window: open() method - Web APIs | MDN

I do see though that setting noreferrer also implies noopener as well, so perhaps that’s what is going on.

At any rate, I would think setting window.opener to null would override everything else as mentioned in the links in the rule info

[eric.morand]

Actually, I think the issue may come from the fact that your code pass the window features as second parameter instead of third.

open()
open(url)
open(url, target)
open(url, target, windowFeatures)

Can you please check my theory?

[Taylor_Ackley]

Thanks, Eric. I’ll check that out.

[Taylor_Ackley]

HI Eric, it looks like your theory is correct and I was incorrect.

The rule is not triggered with either of these conditions:

  sonarTest() {
    const myWindow = window.open('https:/someurl.com', null, 'noopener,noreferrer');
  }

  sonarTest2() {
    const myWindow = window.open('https://someurl.com', 'someWindowName');
    myWindow.opener = null;
  }

Thanks for your response and pointing out the error with the signature.

[eric.morand]

Hello @Taylor_Ackley ,

Thanks a lot for checking and the confirmation. I’m glad your issue is solved - and I actually learned something about window.open.

Eric.