The backlink in the Leaflet map opens in a new window with target="_blank". For security reasons there should be added a rel="noopener".

CommentFileSizeAuthor
#4 leaflet.png672.26 KBeric heydrich
#6 add-rel-noopener-and-noreferrer-to-leaflet.module--3170974.patch649 bytesremz

Comments

Eric Heydrich created an issue. See original summary.

eric heydrich’s picture

eric heydrich
he/him
Primary language German
commented
Issue summary: View changes
itamair’s picture

itamair commented
Status: Active » Postponed (maintainer needs more info)

Sorry which "backlink in the Leaflet map"?
May you give more details and references?

eric heydrich’s picture

eric heydrich
he/him
Primary language German
commented
StatusFileSize
new leaflet.png672.26 KB

Hi itamair,

I've attached a screenshot. It's the backlink at the bottom right corner, which opens in a new window and doesn't the noopener relation.

remz’s picture

remz
Primary language French
commented

I running in the same probleme

I'll try to explain it

When i run a check with lighthouse concerning the map it says in "Best Pratices"

Links to cross-origin destinations are unsafe

Add `rel="noopener"` or `rel="noreferrer"` to any external links to improve performance and prevent security vulnerabilities. Learn more.
Failing Anchors
OpenStreetMap
<a href="https://www.openstreetmap.org/copyright" target="_blank">

It seems that it just need to add an attribute "rel" to the link

I don't know how to make a patche but it seems to be easy i hope.

Thanks in advance

remz’s picture

remz
Primary language French
commented
StatusFileSize
new add-rel-noopener-and-noreferrer-to-leaflet.module--3170974.patch649 bytes

I think I find the way to make a patch.
Tested in my Drupal site version 8.8.9 it work
Now when i check with lighthouse nothing is triggered.

I'm newbie to making patch, using git and all so sorry is something is wrong are not correctly done.

remz’s picture

remz
Primary language French
commented
Title: Backlink to Leaflet » Add rel=noopener and/or rel=noreferrer for security reason
Version: 2.0.x-dev » 2.1.x-dev
Component: Miscellaneous » Code
Status: Postponed (maintainer needs more info) » Needs review

  • itamair committed b8cc38c on 2.1.x authored by remz 
    Issue #3170974 by remz, Eric Heydrich: Add rel=noopener and/or rel=...
itamair’s picture

itamair commented
Status: Needs review » Fixed

Thanks @remz. You patch works perfectly ... Committed into dev. Will be part of the next release.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.