You are viewing a single comment's thread from:
RE: Steemit target _blank vulnerability inspection
This is not XSS.
Also, Steemit already does this. SanitizeConfig.js, line 180.
if (!href.match(/^(\/(?!\/)|https:\/\/steemit.com)/)) {
// attys.target = '_blank' // pending iframe impl https://mathiasbynens.github.io/rel-noopener/
attys.rel = highQualityPost ? 'noopener' : 'nofollow noopener';
attys.title = getExternalLinkWarningMessage();
}
The attack doesn't work for me (I'm running Firefox).
It's not an XSS attack per se but if one of the trusted sites, A, has been compromised by an XSS attack, with the ability to inject a script then this attack can be leveraged to also compromise the access credentials to site B (steemit in this case) by redirecting the login attempt on site B to a malicious imitation of site B's login page.
AFAIK nofollow and noopener don't fix the issue on Safari and other old versions of popular browsers.