Fluentui: rel="noopener noreferrer" is not added for external link for Nav

Created on 24 Jan 2020 · 3Comments · Source: microsoft/fluentui

Environment Information

Package version(s): 7.84.0
Browser and OS versions: N/A

Please provide a reproduction of the bug in a codepen:

Codepen Demo

https://codepen.io/dance2die/pen/ZEYwdRX?editors=0010

Reproduction Steps

Go to https://developer.microsoft.com/en-us/fabric#/controls/web/nav
Scroll down to "Nav similar to the one in this demo app" section
Export to Codepen.
Replace internal links with external links.
e.g.)

<Nav
      styles={{ root: { width: 300 } }}
      ariaLabel="Nav example similiar to one found in this demo page"
      groups={[
        {
          name: 'External Links',
          expandAriaLabel: 'Expand Basic components section',
          collapseAriaLabel: 'Collapse Basic components section',
          links: [
            {
              key: 'r/reactjs',
              name: 'r/reactjs',
              url: 'https://www.reddit.com/r/reactjs/',
              target: "__blank"
            },
            {
              key: 'Nav',
              name: 'Fabric Nav',
              url: 'https://developer.microsoft.com/en-us/fabric#/controls/web/nav'
              ,target: "__blank"
            }
          ]
        }
      ]}
    />

Open a new preview window.
View the generated source on links.
You can see that rel="noopener noreferrer" is not added for the external links.

Actual behavior:

rel="noopener noreferrer" is not added for external links with target specified for Nav component.

Expected behavior:

Generated anchor tags must have rel="noopener noreferrer".

Nav.base.tsx implements it but rel attribute isn't added.

Priorities and help requested:

Are you willing to submit a PR to fix? No

Requested priority: High (security issue)

Nav Fixed Type

Source

dance2die

All 3 comments

Hi @dance2die, thanks for filing this issue! I can confirm this is happening and have a pretty good idea as to why so I should have a fix relatively soon. Thanks!