From d0f0b3ee2e9586ef4750aeff72042a79f57b5d28 Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Thu, 26 Feb 2026 17:30:59 +0000 Subject: [PATCH] Fix: Add rel="noopener noreferrer" to target="_blank" link in channel profile This commit addresses a security vulnerability in `views/channel-profile.html` where an external link with `target="_blank"` was missing `rel="noopener noreferrer"`. This could allow the target page to manipulate the `window.opener` object (reverse tabnabbing). Changes: - Added `rel="noopener noreferrer"` to the `#channelWebsite` anchor tag. Verification: - Confirmed the attribute is present using a Playwright verification script. - Confirmed no visual regressions. - Ran linting checks (passed). - Ran unit tests (pre-existing unrelated failures in NIP compliance noted). Co-authored-by: PR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com> --- verification/channel_profile.png | Bin 0 -> 13319 bytes views/channel-profile.html | 1 + 2 files changed, 1 insertion(+) create mode 100644 verification/channel_profile.png diff --git a/verification/channel_profile.png b/verification/channel_profile.png new file mode 100644 index 0000000000000000000000000000000000000000..ce2ade6cfa6552c651ac9b30943d5d2d8f31b58d GIT binary patch literal 13319 zcmeHuX;f3$wk|d$b)=N4Qz}ZUrGknO1*MCS(z2jL1VII)No;@!p$%OmA<^QXr4*o` zMB0=hAVNS05Fmu02uKqmP3S@r8bb(80)zxY2zeXMy<^-n-aYS(H{N}B+#mIa&E9LT zZtgk1Z?12xJi6>?w`05Jb`=$s9T$E%@1mme74Yxo&tGo_EZ}V>s$W7(1tP!oyW7mFI`GM|InUL2r^eR|HoYbeg+*2tdYka$7_*{o-|E?#! zr=B!i4clbe@bgK%&A+Yq9E-f6>3^fvEVyt#@n}o@QLn?Vf`9$ZWb=!*_T3tehQXt1 z&S9QmheX13cJ@tmOVWb<&_3c9Cd-CKP+jP_tCb=bKp1y(!ta#1p9h8)N(Ju%#`mMj z))T4+wzgy3$YypP6b<;OM!MFdh;3h+5t=YW(yV>d6dh&r5$lAPCaPB%Yu z^G9xpKa71(SpG;iSN7^Dy1tKQUwb@mvC-taE$CVI<5dipSC%zx*||Kn@#UllyZo8K zMxIdED6H^-Awfpnw{2Fsl83|WMp@i7=^#lNI}~y)VX(5Y(!%Y?p6xO(vrLeyCVTYM zBcS^cb`}5YIjQs(x=dTO({Cqcd4hM-Zf7YwjI{$NgPHY6*+WAy0f*T+wxWZ{nCUfn zW_CxQmvFa79Q3r-&#i&IL^mNw-JtPi(Tk1tyeqgyp9Q#N<>IKijyDA(mqta*k2QgX zb<=oZt$gnNDQqr19IhNEW0jE_zmb{(sNFFY<~bcHx0>t@|nlY{YIFgD^UA zOL90!X>S}DWQPD5uyCZXd6@>N?gVYQdvKQb-t9>T|H3Y~30RWpV8uLV19LytPZ>XC zpHGcBNlH7))MUEYeBV;zLNy;m%cqX@oGnU$>R&6a+SYR@Be{FJ8Br5JayFU>Z~7YO z844#@HYCh4`}?E_nsJ~}XEqlr8}4f!B;q@R2$XjN`;4)bK0_gu+q$gjwnr(Xo4UI* z;^t9jrp(9Q$DmIngfk_!f<6o5s~(E3h+(5k6k_L{`hKbJ`RM6HY`t}sL$ku8yU<+T z<4{%wHPp>?g3CM#D9{bNMM~4RWHpOS;_z4QFI8E*s}}sEx5|Vmp0f$&u)RxtTH`1i z-9^1jo=s1H>voD5XWA4K4o8`#(wkc&(q@d4cf*k~Fa1>A%g1~kkYst+NKl$};*`+B z*i5bcb?5Gc!Pnr7&Z44*&OHbwa)q*e!}&VbHq{MqlA?scj-Dt)*l3;_L+`hp?1;&< zpH!m=3iRUK5LcES2eFy`M2w$`K^t7)r$R{{o#Z0+*@BD&ekzvSG&SZC*}AfaL7U9??}~>mN4S zmvYTPI$Ipayz;sN_85yeK6`+mZK#)eZbg)NZ8MBn8}?b`)~~?DILZ}TVIom)bsnea zPS3?vU!j3$s|)!0MV4E=eb&w;-9d+m3n>l;Bnz1F1UBV6mV+7LlHa)C%zDU~`_g`X z*R5O)70YpD^K@l|-*N_3Ii`mhy&}WqV8f-DMFk%O_5ZH;PUWre0{P;^Y#!3)dw6)d zkCjK&G{z*o&ZKMU(xdP^`Fs{b64mH^(~WRGxNTlik#>R*#`E%#a?B`>h* z^0a~AN8uY1M?MbG{YGCr_!_d8K0zA&1CmbHk9)toxZK9#3$E3&WBe{tjdZ>-e)g7L z@wc90-ERuCNY17BoOQr!*j+q(5~WqiQl~9G)xd_1ltOKkjqPORG5NzWP z^L0?3%OS&6Kzq7CId$?7#UjydSk_B8b5b{%k!2aq&yLPeS$8lr*Je|l1*yipuA;J1 zQ5(L~*bH>sX8w`WFh=a8=+d(e>-WyHNID2Kh*D>XfnaZv$`TStd<}?wRfxqd1zTNj zrN(n-KDPkIPnjhWdEM9b6q9zs>fE{65S)Bwkc20IwR*!5h?=1r8xDv5kh7_dN*#b6 zZ@EuO-_nAMvAm4=GB>0{W`{11AO|OjL}Ecs%oG_rO~#6rup$|sfcx^4OPT2%MD2Yp zqQu(FBynOkF$^024UjViM0+L|X)U;wxra$5-u1C)a4l+nOedNnxfsokT^<=4@~F5g zoWZU3iImH~Rp3%@QJ-qzS=7;D7rJc-)I?~Ok!nkOhBkx)oYjDsHQij7Z99j{$yN%N z7|^xnUIRl(eNe|LrQi6N7z9P##LnlDSnYA3^u%o!UcLZ5GnDxZu=X`&CtFpXtJ}jj zq;pU?x~4O|?J}>zE`mPkZ0^-h8flN2eW6w15kZQw0<;8KIHXJO*+E1epjqX+`{(nI zs~6^LbX?0!3^++Jv;_?Qt~7Q+1ytn*14vF$`>xU=8Y}08duqYSP%Cn*@WU;5HOkja zGhdOJFplwP5IaX(TvW5TQcU(>jypdydcHklfy zKV8UoN1T34&Uq8Dtr430LYMF{uP@X@H@TL1H`+RAZ1IW2V}1Z*)!uK#me_9v1|uH| z*@`O5*iy%OkB&9kV;(yfM_VbPm7|9uEPi?Hue5dcXkeZ*nc5NMx8RphX^*uUNZ*rn zT;0$u%}ASfjBe{MyOc$TzmoZ^tvsToyX0Pna@2I-<>@FJH1EmcD<<-#JL2!Nw&tsp zZbp?+b!LazSygj=V;?SRa58%_If=V)#b8a^ zrAJ70uxoUn_LNLS>8fQpEcDzW^%HtC<1KXlTGIQN=tqWh+T~W4_t1K1ns&lbY7CGq^Szac)Sg zk_UmF_r!}<+?2~?C0%@t7LYa&+g3PIVfT>7}GRG3S+GfG~B6|HbC0jEsk z5t-t!C8dYbJXy(9;#L@IK8yVt;r`lOWV;cmOZ_n&MnS`~mM`n$lUrZ`t3xqx3r6gz z71G(58*4(?s(jGX57#ZDb7#)j(APw?1>6_qidG^_4gqs>{M6EEtJ2Uj%5;{^oCa-4 zVy8sv!g11E0Md-YHp1XKW#%uorQN}h)owfJ^85R=7}=^ih`UxQlBtt1H!Lyo|L>6h z^$ozJzwTeBfv(SY) zC#}1SX1fAyys7V210IK&!Gaf|r{$>9B_L!PD3e3m<^n$-=SpfGJ`BqfQvnhb7D7pT zoeWZCj*7#n!Ih!?TVUvgt1fSFvUc?}(*nZX1%&#ucEO7vuRGu9JDouxqYs&17$cy@sHftqLHiy;s39xHYww@EjrL@uxo&8LI<%UH&vwk(3cX72dZpjB~A^CDp zoeL|ea(kImBzXX<=MQwg*K%63%{9$wNw>J}c#318SUjkXF(H7M6p}^eBeR|$P*%*$ zs0WoKmrK#f>#4FR2cg*@_$^3ub(fA|pXT#(W|@YrnzIvz2`=;pM2Vf7S^%4Khdd>* zCB@v5^-P#jIVO6hHC|Q$wc#@YD79PLPguw2$c0pe`@}J9bX6TkG3LwmKrAk4Z|i)P zAy7L4g59d=JEF(6E&vbggLnFn2HE{#UphfMTN<&Y5bZN4esGrF(Nn6qH$!S>6DTaR zmd5#j-)%|IhKN;LG|@KKMfCNdbN#L6v_LIaSb4thI}H@00_Mq<^1*A}`M2MI z6&9He{L)8EuS!VzCEGY`Da(J4sT=9n@chf72uS#?rGhK4iw}KU#Qo->`2#ai0r3~z zem70O7@OTOf#$r?hO5cgDO`sXpJ>mu=Rx3t`kIYz44%x`7Mg$AxVZTS47KnQw)Q2+ zT#vr%7=5ktU4RL}G5X<;=DHMRRW1TyCqj(~=-Ed2lv<+x(7$T|3%l)*{vpCs0h+}M zs1fe;U$pthW`%JEpdDKv(jSSID8-3TeLTb4CLa@-Z1=b{beP9V6V1}8cEI#G7aqPs z9NF<%5;3`SzXdwLemCEds~#I*0<+0BPpxygXD3`eM~;+@$BaAJL?`BSXC5`Pnhle! z*|}~hV_ZW6&7v0|vj+^(1iMefBo6kw#n49N2oQh~zudZ#7E}PoJ=|AOV zLSW$Syoa)mp4!$k^@hT6SGM&~_F>*qI7EC#I_hrk#ME2at+K@^-bldN;?|1Q&z+yA zi@rBcmj>j)pv-yV5@s}$XlrTi4T@cO34et+ki>nt(N|`b(&%$o$qN?srA5Z?wx#Ga z2F7GBJx#TV0+FH{uRk;D1LqDVFtFnH@+jAP8A%0Vo~9dR%PXy(R+jwg9}fOhR{f&a z>-NK`PzufT!V)U4t9Vy=f7NB~`@eS}w%z1a;uf{%LXsIF@N{iy3}?22#+f{mdbHm- zF+zVlxG2(pp65{C?H)2r^4ffii=fw}V36z8VHDs4I-*r}vnGy8Z1uFwfueB(qE}sRpsK_Ym*|Rr=Qk z;PTIPsedY1{U-$$?^>iA>#^xiL$}H{mUA)uJ$Hci|2Z#@ocv|I|M$0_0GF?S_59=i z$lo9CPX?VPEM_n<`d5UG*6x1+<`Uh-(r!q{R5}~_jRPE^!nqcF|3A?G%w4s`YEQ$D zh(RP3YQ!@M(}x8t7F;-`7yVWifi817ir-!nSaMaA#CJZW6&cXvkUyYl;B2B((W5uU zR5xs`;1(MtGxG3)OA{MP2TA(P$hpevhPnx+O&&#%oZmfU7s$`|0EmU?+umXl9|J$3 z?X)ei+O4$GRvcL70pdkXtTfjksZU+SzHaS%w2H2JX6WhxQ*8hXcI?`?xha;m)={|=yFFr@~ z_$}9G*qD#xNs)Pz)OuCG^avjYUxi^CHyUv}ZBca`V`(Z>F912@z7KUdZdcTzdAhCf z(BttVo&rh##r91jyv=Sz7**Rhl+M5_$yqn+`j>#ghh8c++LK@&dCuw_>)3Po^Y`zre=Y!?*TJ+Oa~?#U#GAFs_#@Ym(n2KkeJ;b#96@<;hsbN#e6 zi7CAE%+heUTsxckJ_5tde3*A5OPdzo?F-5!3(+Na)%(0F(Us4$y29%{j}<ez2ds}< zFDtOdKtVqlSZ>4&sT)Bai{2JmQ1$dWI?RaT?0;xnmPc&uJAS>m-m}B*0(HT~7<&?C3C=Qt zMj|IJSBAZQ;hj*@c56uPd_akWm+P!MJ?l0@r6k(sbDgPG8l*d*DZZn#YSvlqK&4b_ z_IkJP8h4ccQWo(OCA=b{l8E+ApSh12{n3~d{&co=Znd}J4|ys^rN>Yjq%PU$@gZ&Ry)&GmI&0lve!Hq^moy?Y-{l2gEXK_9`bM7Lr6u?) zy@;zW2h16GY%j~wa8R=XYP{Qgdwe2h-j3ZGWn#@O3Gy+~B6dkJ&w2wgldWT4La{YN z^(UOv34vy9S~ARv#Dy4(-B6x9%eX(dhpmO?eVe$V;bwj)Bzc9^)b|u^!lH8ekS=pG zV>hDSxmY}L=g!GQzj9P~;cCIyOrz%P_Ya#>GyB3drkUZncc1A8lgNED zxI1UoZqUN^+rP4i{)vh`q5(=~>`JcCR1L8Xt2SM}Q5t4pN_z(dn;*s9IAv)zrJGUJ zNmQ@;0k8^6EcN~>hHpICwO~By6H^8OyAy{m8t!z+Rt>(;&?c+v4K{ zOk`8spbxr2s{s)f6|}EPz*!j`Uc41j_q>D5C(Q~LcJjB#rc?vs70?C@rXFH_**Gt* z!&x8q<_TLjnM~igzVwhB+O`BQ-}HQv z|4@ZlcY2hk^tL!2=iR41YT)((oZdQtfKBS0rO;v<9MW zxVjOYbdz>NM!9Nu`iA5Fs@Q^x)QG^6nCuy!-0qkR3c^|N04bgMBlS?%{UKy;G$K+< z{N8rD`2){Lo-tT^;aScTVRE=#?RevKu3C0f_i@^p8BQ-zDAVk|@@o0Vy!rbvYX)9$ zAg=Fy)@IA0Ds+_rd7{TRH_p8P1CoG*2 zYxiPZo3KD)MXmC#rHC9+eS%V5U(aYnlWnO9;t!(%H-oGk`s78vuTp=uYRIJPpk|Fe z&wHHW(ghA{4_u-stTX1l4M5YYKAaQxaxHK_5s}Lat+nYNkQXbf(ZTt9qbUzf<49!R z3E78>%!!HeznQAq=f!o6co7#|3NiWCkm1?pc$879cV@Bj&EN|%Wg?NfmujGp!1Uyw>^P_qO<;`1@U0s%g7#zJX1~gRho*quHYZx`6m96$^$TK% zQcRmuqlGqkKa^S;>|Tei$eTb?x?UbiHC6p*Du-%Gon`vQOFCuSPXRBV4OQE?{EMx~ z|0J{fzp1fvrZU&FwM5}wHLPoZkD@FG~Dm=OcD}9885RPb}rc3S}A$ zYvo6woF?JmmWFFI0I{J)WIfN52Q$u_D@rAPJZY?PO2>n2VQPV+b)Vpyf-dH#XCAq& z-xI9E1WT6+;v5D^cgyOpo^K+W(T-wv){YG3*wkl-68FKHX5@p} zyc%kai#59{E2}Om0$5}l6Y?{UUVYo7Xb!}yJ}bu`jxrIFr+MeBjI)FRJK#l^vIDU2 zq2Q|SOx~e}cq-;y=8RpYuGYKSTvWLY&2KzZ9cDD8P@ZBkJ;_zZ?X|EQW z7Y~oK<>B?Pi-I@3G7d?Q(|TJy_U*8{an@hHJXJxpT-?X9hqA0DB*XL*D#`aA*Z3}eqlSztvC zAYIU$VNS46uQ%lW=(XT?w`F}c%$$7O0SmH)xxm$gB=dx}A4`u2;4yZT(?=8ddq6w; z#jSyoo39gLG6QvMtJc%?;$FA*uAbyoTdL&?-^cXPk@w8l87%?iXW~_RrLSYQP0{cl<|c&aM=Eft;#*d_XdXDRXO!KS3p(FLeC|g|Vfd8SxUrqHgu$R_ zJ&)iPDW`3`=9t_Uu|>3~9PC~#=knFVVOF}{-XX%@KQ6J@@a|}u z_8-R2>}wVq!Pb+B#;~}R^!GdC?z$;Y~5QDo|V3AoyH_<##A6ohVi3 zqqAH?y=({D#w$fVNVm7eK31BS(zqW7uWc@wm=5mD7s~=ous7j$e(8@Wa`R??YChf` zEbHyJiDY#-9MIY2xIKQDdHnpfPbE-kpo!;B)I^(v{ev*7MeJiT$=J^9KJ7s^Ofm&) z*q1EZBWpZ+Ap6f?`X46ysXdoC=euLtb35m!8d0NNa#6J<{0#+ z-!7Q2Yp7hXZ=FJ|Dj5ax;$OgN0?m~bW#xeO^oo~P{@vkRdp%Y1i) zbe3WYP?}$^D}emxZ~Vk9sJs2aLF-PKst!5RaaAhh`Zfq>C`gQvoxR(9lw2bxCM>MA z*p1#im@Q6`y_Kf011}{z@!qn#NL<+hUqlI)m^gaRr#F^H9^Gy_$R74Ip0Cqvw_ygE z#at*{>1(;keO-N7z2Vtcg7G9@L7D2Jb#C`xZMo2~vkp_!GUOToRQvrT5h!3o> z&NwsA1Yst=JmPf~==m?{MFCQX6k3Y;TeUoHBw z)cMw->Ip0{va{Lk#g5FXh?no)b`CBw(c_DC*M^0~f@d?vvk`~fKEdoeMVqZ-k6n4Yhx0Q1UF++9VdD6?ye>hq zEw@gz?3hIp_5ddf+K?0B6_!GEgH~U@`iejRUW#Qr$d-oY7&1NBqj#1^OeXoHyIG(w zczAF}e)u#PKt`{wYhTTEet#byABnKqTPLa;JVkfC5(KEnl`E+NpHq7sjnQ9+=DQbh z(xH>_cAAxb(I>Qbsw%L!GYRDs^CJY^DAn=ScPyTsybsl#h>g^hx1ySc;nd$t*Yb}Gxe~@8Z7fEON5BFlHBsMnL3q0A32}8786dDPns5`CULJ9nq|;^lR8_dyrdS#pyH^kVzWNa z_L%G)9uf&BqUJZG)m&y8GMu`$vYk*c{@P!b*j(5uNLYYU)P$t@~use ztZhq|8-%so*3(W(X3GW_`O8IwkR5PJ$bPrCrKSB+FIB5cOO7PwzQlrd^RSua*(Q5Z z<(hp7!)`W)1Wqq4dHx#r;!cTq6lW~3_j*Vb#VN-lw$DI#0n#T4h^pq?u~{8h$osiP zR9Bh-eVY;v1M6R04! z0*Bz-cmBNT7r${w#GdH4B+0~nPpw_tLIDk^QwQIAa&sN#hq+~Q8`&r;VBCdrg^{@x zh?Z}2K2L0%qkFS|LwQj7-;dM%KjyIi@nqgVG$mCVDa9$K;hkA`f$cJ>4KBD3U@Qs*e%GHAF|!mfW&T_@ zO;>w8n@7K}Yyj$Ry~+4)L@T6je!fL7x#V1odrT-`Ar;Y0bmyj|MY7f12b^ll<$W$$xsuH{Whj`F8VvAItm+*#A|4 zT}9M8sG_pv#rkgq{?!ruKmGhqH2f0{{~Pn9zbS$2SE&^87`K3U-?kp3TU5k<`=+qP UWebsite