harden window.open call with noopener,noreferrer

de81e9099d8cca7299b4ba5ba2e00406d66752e3 · 2026-05-25 20:10:13 -0700 · SteveStudio2

mini-constellation node click opens sister-site in a new tab via
window.open(...). Without noopener+noreferrer the new tab gets a live
window.opener reference + leaks Referer header — same family of issue as
target=_blank without rel. Added the third-arg features string.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M public/index.html

Diff

commit de81e9099d8cca7299b4ba5ba2e00406d66752e3
Author: SteveStudio2 <steve@designerwallcoverings.com>
Date:   Mon May 25 20:10:13 2026 -0700

    harden window.open call with noopener,noreferrer
    
    mini-constellation node click opens sister-site in a new tab via
    window.open(...). Without noopener+noreferrer the new tab gets a live
    window.opener reference + leaks Referer header — same family of issue as
    target=_blank without rel. Added the third-arg features string.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 public/index.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/public/index.html b/public/index.html
index 06f7b00..b4a799e 100644
--- a/public/index.html
+++ b/public/index.html
@@ -487,7 +487,7 @@ textarea:focus-visible,
       const isCurrent = n.dataset.slug === SLUG;
       n.querySelector('circle').setAttribute('fill-opacity', isCurrent ? '1' : '0.55');
     });
-    n.addEventListener('click', () => window.open('https://' + n.dataset.slug + '.com', '_blank'));
+    n.addEventListener('click', () => window.open('https://' + n.dataset.slug + '.com', '_blank', 'noopener,noreferrer'));
   });
 })();
 </script>

← 9afa6c1 add: pre-stage Meta Pixel snippet (placeholder; flip via _dw · back to 1950swallpaper · retag aesthetic from PG: 23 rows updated 30e30e1 →