Search code examples
javascriptsecuritycode-analysischeckmarx

Checkmarx : How to solve Unsafe_Use_Of_Target_blank issue?

I have 3 occurances of "Unsafe_Use_Of_Target_blank" vulnerability from Checkmarx, in the following lines of my code (UI5 project):

window.open(new URL(sCustomUrl).origin + "/" + sParam);

window.open(sCustomUrl + this.getView().getModel().getProperty("/ID"));

window.open(this.urlToID);

How can I eliminate the issue in these lines?

Solution

  • When not specifying the target (no second parameter for window.open, or it an empty string or "_blank"), the opened window gains some access to the page that executed the window.open() method (Reverse Tabnabbing).

    Setting the opener property to null, or specifically setting the target when calling window.open, fixes this vulnerability.

    You can get more info about "unsafe use of target _blank" here.