#rails security

While Pull Request fixing issue with OWASP Tabnabbing is still open... since Feb 16, 2017, our shiny Rails applications are in danger. But wait no longer! Just put code like this:

 # frozen_string_literal: true module ActionView module Helpers #:nodoc: module UrlHelper # Same as #link_to, but also adds rel="nofollow" and rel="noopener" if target="_blank" # rel='noopener' is added to mitigate OWASP Reverse Tabnabbing # # external_link_to "External link", "http://www.rubyonrails.org/", target: "_blank" # # => <a href="http://www.rubyonrails.org/" target="_blank" rel="nofollow noopener">External link</a> def external_link_to(name = nil, options = nil, html_options = nil, &block) html_options, options, name = options, name, yield if block_given? html_options ||= {} html_options.stringify_keys! html_options['rel'.freeze] = "#{html_options['rel'.freeze]} nofollow".lstrip html_options['rel'.freeze] = "#{html_options['rel'.freeze]} noopener".lstrip if html_options['target'.freeze] == '_blank'.freeze link_to(name, options, html_options) end end end end 

into one of initializers and enjoy bit of safety. This will add new url helper external_link_to to your disposal, that will mitigate Reverse Tabnabbing endangering your application.

Or, if you feel adventurous today... lets patch link_to itself!

 # frozen_string_literal: true module ActionView module Helpers #:nodoc: module UrlHelper def link_to(name = nil, options = nil, html_options = nil, &block) html_options, options, name = options, name, block if block_given? options ||= {} html_options = convert_options_to_data_attributes(options, html_options) html_options['rel'.freeze] = "#{html_options['rel'.freeze]} nofollow".lstrip html_options['rel'.freeze] = "#{html_options['rel'.freeze]} noopener".lstrip if html_options['target'.freeze] == '_blank'.freeze url = url_for(options) html_options["href".freeze] ||= url content_tag("a".freeze, name || url, html_options, &block) end end end end 

Even better! Now all your existing links with target="_blank" gonna be safe from nasty fishers.

Happy coding and stay safe.