Skip to content

GitLab

  • Menu
Projects Groups Snippets
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in / Register
  • search-index search-index
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
  • Issues 14
    • Issues 14
    • List
    • Boards
    • Service Desk
    • Milestones
  • Merge requests 0
    • Merge requests 0
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Monitor
    • Monitor
    • Metrics
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Repository
  • Wiki
    • Wiki
  • Snippets
    • Snippets
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • Framasoft
  • PeerTube
  • search-indexsearch-index
  • Issues
  • #12

Closed
Open
Created Sep 22, 2020 by Association 42l@Association42lContributor

Add referrer/opener parameters on search results links

Hello,

The links in search results currently sends sensitive data to all PeerTube instances through the Referrer header, such as the search query.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy

They might also allow the target page (a PeerTube instance) to tamper with the original page (search results page) through the Window.opener property.

https://developer.mozilla.org/en-US/docs/Web/HTML/Link_types/noopener

https://mathiasbynens.github.io/rel-noopener/

Solution : add rel="origin noopener" to all search results links, including the links on thumbnails, to only show the FQDN in the Referrer (not the full search query) and prevent the opened page to access the search results document context.

Disclaimer: I'm not a security expert, please review this advice.

~ Neil for 42l

Edited Sep 22, 2020 by Rigel Kent
Assignee
Assign to
Time tracking