private void handleTargetAttribute ( Map < String , String > anchorAttributes ) { String target = anchorAttributes . get ( "target" ) ; // Target can have these values: // // "_blank" which opens the link in a new window // "_self" which opens the link in the same window (default) // "_top" and "_parent" which control the top or the parent window of some frame // "frame-name" (it could be anything) which opens the link in the frame called "frame-name". // // "_self", "_top" and "_parent" are the only safe values. So we need to handle any other value... if ( StringUtils . isNotBlank ( target ) && ! "_self" . equals ( target ) && ! "_parent" . equals ( target ) && ! "_top" . equals ( target ) ) { List < String > relAttributes = new ArrayList <> ( ) ; // Parse the current values String relAttribute = anchorAttributes . get ( REL ) ; if ( relAttribute != null ) { relAttributes . addAll ( Arrays . asList ( relAttribute . split ( " " ) ) ) ; } // Add the "noopener" attribute if ( ! relAttributes . contains ( NOOPENER ) ) { relAttributes . add ( NOOPENER ) ; } // Add the "noreferrer" attribute if ( ! relAttributes . contains ( NOREFERRER ) ) { relAttributes . add ( NOREFERRER ) ; } // Serialize the attributes if ( ! relAttributes . isEmpty ( ) ) { anchorAttributes . put ( REL , String . join ( " " , relAttributes ) ) ; } } }
When a link is open in an other window or in an other frame the loaded page has some restricted access to the parent window . Among other things it has the ability to redirect it to an other page which can lead to dangerous phishing attacks .