External Link Noopenizer

If pages on your site contain links to untrusted sites and those links open in a new window, your users may be vulnerable to phishing attacks. A full explanation of this vulnerability is available here and here. The long and short of it is that links opened in a new window are granted some access to the originating window. Therefore, if your site links to an external site and that site is opened in a new window (eg. via a 'target="_blank"'), the external site could, for example, redirect the window your site was open in to a phishing page that looks like the login screen for your site.

To prevent this, all links on your site that point to untrusted sites and open in a new window should have a rel attribute that contains at a minimum "noopener" and "noreferrer".

There is also a performance improvement that can result from adding these values to the rel attribute on your links.

The goal of this module is to provide a suite of tools that will help mitigate the risks of this type of vulnerability. Here are some of the potential features:

• Add a warning message to pages which contain vulnerable links (complete).
• Add JavaScript to all pages which detects and fixes vulnerable links by adding noopener and noreferrer values to the links' rel attributes (complete).
• Add a whitelist for trusted domains so that the module doesn't affect links to trusted sites (complete).
• Highlight vulnerable links with special CSS styling.
• Provide an input filter to fix vulnerable links.
• Ignore vulnerable links if they have a particular class or data attribute.

There are no plans at this time to handle the same vulnerability that comes from using the window.open() function from within javascript.