Add referrer/opener parameters on search results links
Hello,
The links in search results currently sends sensitive data to all PeerTube instances through the Referrer
header, such as the search query.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy
They might also allow the target page (a PeerTube instance) to tamper with the original page (search results page) through the Window.opener
property.
https://developer.mozilla.org/en-US/docs/Web/HTML/Link_types/noopener
https://mathiasbynens.github.io/rel-noopener/
Solution : add rel="origin noopener"
to all search results links, including the links on thumbnails, to only show the FQDN in the Referrer
(not the full search query) and prevent the opened page to access the search results document context.
Disclaimer: I'm not a security expert, please review this advice.
~ Neil for 42l