[object Object]

← back to AbramsOS

add noreferrer to target=_blank external links

20f8f364d23f5c6a6deda3b1122f571dcc391663 · 2026-05-19 17:26:42 -0700 · Steve

CPSC notice + cited-rule source links now use rel="noopener noreferrer"
instead of bare rel="noopener" so we don't leak Referer to upstream pages.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

Diff

commit 20f8f364d23f5c6a6deda3b1122f571dcc391663
Author: Steve <steve@designerwallcoverings.com>
Date:   Tue May 19 17:26:42 2026 -0700

    add noreferrer to target=_blank external links
    
    CPSC notice + cited-rule source links now use rel="noopener noreferrer"
    instead of bare rel="noopener" so we don't leak Referer to upstream pages.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 views/claim-detail.ejs | 2 +-
 views/recalls.ejs      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/views/claim-detail.ejs b/views/claim-detail.ejs
index 9c0d2e4..79f5668 100644
--- a/views/claim-detail.ejs
+++ b/views/claim-detail.ejs
@@ -31,7 +31,7 @@
         <li style="font-size:13px;color:var(--text-dim);margin-bottom:8px">
           <strong style="color:var(--text)"><%= rule.citation %></strong> — <%= rule.short_title %>
           <% if (rule.source_url) { %>
-            <a href="<%= rule.source_url %>" target="_blank" rel="noopener" style="margin-left:8px;font-size:11px">source ↗</a>
+            <a href="<%= rule.source_url %>" target="_blank" rel="noopener noreferrer" style="margin-left:8px;font-size:11px">source ↗</a>
           <% } %>
         </li>
       <% }) %>
diff --git a/views/recalls.ejs b/views/recalls.ejs
index 9329e0c..5874466 100644
--- a/views/recalls.ejs
+++ b/views/recalls.ejs
@@ -47,7 +47,7 @@
         <% } %>
         <p class="subtle" style="font-size:11px">
           Confidence: <%= Math.round(m.confidence * 100) %>% · matched <%= new Date(m.matched_at).toLocaleString() %>
-          <% if (m.url) { %> · <a href="<%= m.url %>" target="_blank" rel="noopener" style="margin-left:6px">CPSC notice ↗</a><% } %>
+          <% if (m.url) { %> · <a href="<%= m.url %>" target="_blank" rel="noopener noreferrer" style="margin-left:6px">CPSC notice ↗</a><% } %>
         </p>
       </article>
     <% }) %>

← 3458fe1 tick 18: receipt extractor regression fixtures + heuristic f  ·  back to AbramsOS  ·  ignore + 404-guard backup/snapshot files 551b5ea →