fix: add rel="noopener noreferrer" to target=_blank links missing it

771aaa9c01d15df69d3ce849e15f7ac9d441ae8e · 2026-05-31 00:05:23 -0700 · SteveStudio2

Three anchor elements in src/server/index.js (build URL kv-row, wa peek
drawer FULL link) and five Quick Open sidebar links in
src/render/builds-index.js were missing rel="noopener noreferrer",
exposing opener context to cross-origin pages. All fixed; syntax clean.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Files touched

M src/render/builds-index.js
M src/server/index.js

Diff

commit 771aaa9c01d15df69d3ce849e15f7ac9d441ae8e
Author: SteveStudio2 <stevestudio2@SteveStacStudio.lan>
Date:   Sun May 31 00:05:23 2026 -0700

    fix: add rel="noopener noreferrer" to target=_blank links missing it
    
    Three anchor elements in src/server/index.js (build URL kv-row, wa peek
    drawer FULL link) and five Quick Open sidebar links in
    src/render/builds-index.js were missing rel="noopener noreferrer",
    exposing opener context to cross-origin pages. All fixed; syntax clean.
    
    Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 src/render/builds-index.js | 10 +++++-----
 src/server/index.js        |  4 ++--
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/src/render/builds-index.js b/src/render/builds-index.js
index cc08887..c384c9a 100644
--- a/src/render/builds-index.js
+++ b/src/render/builds-index.js
@@ -831,11 +831,11 @@ function sidebarNav(rows, activeView, activeGrade, activeCat) {
     <div class="sb-section"><div class="sb-h">★ Categories</div><ul>${catItems}</ul></div>
     <div class="sb-section"><div class="sb-h">★ Starred · Local</div><ul id="starred-list"><li class="sb-empty">no starred yet</li></ul></div>
     <div class="sb-section"><div class="sb-h">★ Quick Open</div><ul>
-      <li><a href="/" target="_blank">/  Salon Directory</a></li>
-      <li><a href="/admin/enrichment" target="_blank">/admin/enrichment</a></li>
-      <li><a href="/near" target="_blank">/near drive map</a></li>
-      <li><a href="/press" target="_blank">/press feed</a></li>
-      <li><a href="/healthz" target="_blank">/healthz JSON</a></li>
+      <li><a href="/" target="_blank" rel="noopener noreferrer">/  Salon Directory</a></li>
+      <li><a href="/admin/enrichment" target="_blank" rel="noopener noreferrer">/admin/enrichment</a></li>
+      <li><a href="/near" target="_blank" rel="noopener noreferrer">/near drive map</a></li>
+      <li><a href="/press" target="_blank" rel="noopener noreferrer">/press feed</a></li>
+      <li><a href="/healthz" target="_blank" rel="noopener noreferrer">/healthz JSON</a></li>
     </ul></div>
   </aside>`;
 }
diff --git a/src/server/index.js b/src/server/index.js
index 0ddceb2..9a00215 100644
--- a/src/server/index.js
+++ b/src/server/index.js
@@ -3664,7 +3664,7 @@ pre.readme{background:#fafaf6;border:none;padding:14px;font-family:'Space Mono',
         <div class="kv-row"><strong>Name</strong><span class="v">${safe(build.name)}</span></div>
         <div class="kv-row"><strong>Path</strong><span class="v">${safe(build.path)}</span></div>
         <div class="kv-row"><strong>Category</strong><span class="v">${safe(build.category)}</span></div>
-        ${build.url ? `<div class="kv-row"><strong>URL</strong><span class="v"><a href="${safe(build.url)}" target="_blank">${safe(build.url)}</a></span></div>` : ''}
+        ${build.url ? `<div class="kv-row"><strong>URL</strong><span class="v"><a href="${safe(build.url)}" target="_blank" rel="noopener noreferrer">${safe(build.url)}</a></span></div>` : ''}
         ${build.port ? `<div class="kv-row"><strong>Port</strong><span class="v">${build.port}</span></div>` : ''}
         ${build.last_at ? `<div class="kv-row"><strong>Last Worked</strong><span class="v">${safe(build.last_at.slice(0,10))} · ${fmtTime(Date.parse(build.last_at))}</span></div>` : ''}
         ${build.has_git ? `<div class="kv-row"><strong>Git Branch</strong><span class="v">${safe(branch)}</span></div>` : ''}
@@ -4295,7 +4295,7 @@ app.get('/api/wa/:slug/peek', async (req, res) => {
   <div style="display:flex;gap:10px;margin:14px 0;align-items:center;flex-wrap:wrap">
     ${ar ? `<div style="background:${ar.score>=70?'#22c55e':ar.score>=50?'#84cc16':ar.score>=30?'#facc15':'#dc2626'};color:#000;border:3px solid #000;padding:8px 14px;display:flex;gap:10px;align-items:center"><div style="font-family:'Archivo Black',sans-serif;font-size:36px;line-height:1">${ar.score}</div><div style="font-size:10px;font-weight:700">/100<br>★ AUDIT</div></div>` : ''}
     <button data-star="${esc(a.slug)}" type="button" style="background:#fff;color:#000;border:3px solid #000;padding:8px 14px;font-family:'Archivo Black',sans-serif;font-size:13px;text-transform:uppercase;cursor:pointer">★ STAR</button>
-    <a href="/wa/${esc(a.slug)}" target="_blank" style="background:#000;color:#facc15;padding:8px 14px;font-family:'Archivo Black',sans-serif;font-size:13px;text-transform:uppercase;text-decoration:none;border:3px solid #000">★ FULL ↗</a>
+    <a href="/wa/${esc(a.slug)}" target="_blank" rel="noopener noreferrer" style="background:#000;color:#facc15;padding:8px 14px;font-family:'Archivo Black',sans-serif;font-size:13px;text-transform:uppercase;text-decoration:none;border:3px solid #000">★ FULL ↗</a>
     <form method="post" action="/api/wa/${esc(a.slug)}/deep-dive" style="display:inline;margin:0">
       <button type="submit" style="background:#facc15;color:#000;border:3px solid #000;padding:8px 14px;font-family:'Archivo Black',sans-serif;font-size:13px;text-transform:uppercase;cursor:pointer">★ DEEP-DIVE</button>
     </form>

← dadcde3 snapshot: 66 file(s) changed, +54 new, ~12 modified · back to Small Business Builder · auto-save: 2026-06-24T15:27:54 (1 files) — src/server/index. 0a5f356 →