add rel=noopener noreferrer to all target=_blank external links

9713e54811ba7bcc0215853c04ddb0381f304158 · 2026-05-19 21:40:57 -0700 · Steve Abrams

Covers wine result links in wine-search.html and verify.html plus
window.open in app.js. Prevents reverse-tabnabbing / opener leak.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M public/js/app.js
M public/verify.html
M public/wine-search.html

Diff

commit 9713e54811ba7bcc0215853c04ddb0381f304158
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Tue May 19 21:40:57 2026 -0700

    add rel=noopener noreferrer to all target=_blank external links
    
    Covers wine result links in wine-search.html and verify.html plus
    window.open in app.js. Prevents reverse-tabnabbing / opener leak.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 public/js/app.js        | 2 +-
 public/verify.html      | 2 +-
 public/wine-search.html | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/public/js/app.js b/public/js/app.js
index ae401b2..4a73e4a 100644
--- a/public/js/app.js
+++ b/public/js/app.js
@@ -265,7 +265,7 @@ function createWineItem(wine) {
     linkBtn.className = 'view-history-btn';
     linkBtn.textContent = 'VIEW ON SITE';
     linkBtn.style.marginLeft = '10px';
-    linkBtn.addEventListener('click', () => window.open(wine.url, '_blank'));
+    linkBtn.addEventListener('click', () => window.open(wine.url, '_blank', 'noopener,noreferrer'));
     actions.appendChild(linkBtn);
   }
 
diff --git a/public/verify.html b/public/verify.html
index 50c2cb0..cf3abf8 100644
--- a/public/verify.html
+++ b/public/verify.html
@@ -1705,7 +1705,7 @@
                 ` : ''}
               </div>
               ${wine.url ? `
-                <a href="${wine.url}" target="_blank" style="color: #d4af37; text-decoration: none; font-size: 14px; font-weight: 600; display: flex; align-items: center; gap: 4px;"
+                <a href="${wine.url}" target="_blank" rel="noopener noreferrer" style="color: #d4af37; text-decoration: none; font-size: 14px; font-weight: 600; display: flex; align-items: center; gap: 4px;"
                    onclick="event.stopPropagation();">
                   View Details →
                 </a>
diff --git a/public/wine-search.html b/public/wine-search.html
index e50649b..52ca13e 100644
--- a/public/wine-search.html
+++ b/public/wine-search.html
@@ -271,7 +271,7 @@ function displayWines(wines) {
   const html = wines.map(wine => `
     <div class="wine-item">
       <div class="wine-name">
-        ${wine.url ? `<a href="${wine.url}" target="_blank" style="color: #ec4899; text-decoration: none;">${wine.name} →</a>` : wine.name}
+        ${wine.url ? `<a href="${wine.url}" target="_blank" rel="noopener noreferrer" style="color: #ec4899; text-decoration: none;">${wine.name} →</a>` : wine.name}
       </div>
       <div class="wine-price">$${wine.price.toFixed(2)}</div>
       <div style="margin-top: 8px; font-size: 14px; color: #999;">

← 56cffaa snapshot: 1 file(s) changed, ~1 modified · back to Wine Finder · guard static-file routes against .bak/.pre-/.orig snapshot l c5daa13 →