VBC-950: window-open-without-noopener

error

Category: security
Analysis: Regex (line by line)
File types: .js, .ts, .tsx, .jsx, .astro
Scope: source code only, ignoring anything inside strings and comments
Tags: security

What it reports

window.open() at line {line} without 'noopener'. The page it opens gets a handle on this one and can navigate it. Pass 'noopener' in the third argument, or keep the handle deliberately if the code needs it.

Flagged

window.open(url, '_blank');

window.open(`${base}/issues/new`, '_blank')

onClick={() => window.open(previewUrl, '_blank')}

Not flagged

window.open(url, '_blank', 'noopener');

window.open(target, "_blank", "noopener,noreferrer");

const win = window.open('', '_blank');

const win = window.open("about:blank");

const win = window.open();

popup.close();

Pattern

window\.open\(\s*(?!\))(?!['"`]\s*['"`])(?!['"`]about:blank)(?![^\n]*noopener)