bito-code-review[bot] commented on PR #42214:
URL: https://github.com/apache/superset/pull/42214#issuecomment-5013551824
<!-- Bito Reply -->
The security concern regarding reverse-tabnabbing is valid. When using
`markdown-to-jsx` to render raw HTML anchors with `target="_blank"`, the
browser does not automatically restrict the `window.opener` property, which can
be exploited by a malicious linked site. To resolve this, you should ensure all
external links with `target="_blank"` include `rel="noopener noreferrer"`.
Since `markdown-to-jsx` allows overriding components, you can globally
enforce this by providing an override for the `a` tag in your `MarkdownToJsx`
configuration:
```tsx
<MarkdownToJsx
options={{
overrides: {
a: {
props: {
target: '_blank',
rel: 'noopener noreferrer',
},
},
},
}}
>
{markdownContent}
</MarkdownToJsx>
```
Alternatively, if you prefer to update the markdown content directly, you
can manually add the `rel` attribute to the anchor tags: `<a href="..."
target="_blank" rel="noopener noreferrer">...</a>`.
Regarding other comments on this PR, the provided comment file is empty, so
there are no additional suggestions to address.
**superset-frontend/packages/superset-ui-core/src/components/DesignSystem.stories.tsx**
```
<MarkdownToJsx
options={{
overrides: {
a: {
props: {
target: '_blank',
rel: 'noopener noreferrer',
},
},
},
}}
>
{markdownContent}
</MarkdownToJsx>
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
