review client side _target=blank (closes #7411)

ui/analyse/src/actionMenu.ts

@@ -96,6 +96,7 @@ function studyButton(ctrl: AnalyseCtrl) {
     attrs: {
       href: '/study/' + ctrl.study.data.id + '#' + ctrl.study.currentChapter().id,
       target: '_blank',
+      rel: 'noopener',
       'data-icon': '4'
     }
   }, ctrl.trans.noarg('openStudy'));
@@ -144,9 +145,13 @@ export function view(ctrl: AnalyseCtrl): VNode {
       ctrl.ongoing ? null : h('a.button.button-empty', {
         attrs: {
           href: d.userAnalysis ? '/editor?fen=' + ctrl.node.fen : '/' + d.game.id + '/edit?fen=' + ctrl.node.fen,
-          rel: 'nofollow',
-          target: ctrl.embed ? '_blank' : '',
-          'data-icon': 'm'
+          'data-icon': 'm',
+          ...(ctrl.embed ? {
+            target: '_blank',
+            rel: 'noopener nofollow',
+          } : {
+            rel: 'nofollow',
+          }),
         }
       }, noarg('boardEditor')),
       canContinue ? h('a.button.button-empty', {

ui/analyse/src/explorer/explorerView.ts

@@ -118,7 +118,7 @@ function openGame(ctrl: AnalyseCtrl, gameId: string) {
   fenParam = ctrl.node.ply > 0 ? ('?fen=' + ctrl.node.fen) : '';
   let url = '/' + gameId + '/' + orientation + fenParam;
   if (ctrl.explorer.config.data.db.selected() === 'masters') url = '/import/master' + url;
-  window.open(url, '_blank');
+  window.open(url, '_blank', 'noopener');
 }
 
 function gameActions(ctrl: AnalyseCtrl, game: OpeningGame): VNode {

ui/analyse/src/study/relay/relayManagerView.ts

@@ -36,7 +36,8 @@ function renderLog(ctrl: RelayCtrl) {
     const err = e.error && h('a', {
       attrs: {
         href: ctrl.data.sync.url,
-        target: '_blank'
+        target: '_blank',
+        rel: 'noopener nofollow',
       }
     }, e.error);
     return h('div' + (err ? '.err' : ''), {

ui/analyse/src/study/studyShare.ts

@@ -130,6 +130,7 @@ export function view(ctrl: StudyShareCtrl): VNode {
             attrs: {
               href: '/developers#embed-study',
               target: '_blank',
+              rel: 'noopener',
               'data-icon': ''
             }
           }, ctrl.trans.noarg('readMoreAboutEmbedding'))

ui/analyse/src/view.ts

@@ -202,6 +202,7 @@ function controls(ctrl: AnalyseCtrl) {
         attrs: {
           title: noarg('analysis'),
           target: '_blank',
+          rel: 'noopener',
           href: ctrl.studyPractice.analysisUrl(),
           'data-icon': 'A'
         }

ui/dasher/src/links.ts

@@ -23,7 +23,7 @@ export default function(ctrl: DasherCtrl): VNode {
 
       h(
         'a.text',
-        linkCfg('/account/preferences/game-display', '%', ctrl.opts.playing ? {target: '_blank'} : undefined),
+        linkCfg('/account/preferences/game-display', '%', ctrl.opts.playing ? {target: '_blank', rel: 'noopener'} : undefined),
         noarg('preferences')),
 
       !d.coach ? null : h(
@@ -104,16 +104,13 @@ export default function(ctrl: DasherCtrl): VNode {
   ]);
 }
 
-function linkCfg(href: string, icon: string, more: any = undefined): any {
-  const cfg: any = {
-    attrs: {
-      href,
-      'data-icon': icon
-    }
-  };
-  if (more) for(let i in more) cfg.attrs[i] = more[i];
-  return cfg;
-}
+const linkCfg = (href: string, icon: string, more?: Record<string, string>) => ({
+  attrs: {
+    href,
+    'data-icon': icon,
+    ...(more || {}),
+  }
+});
 
 function modeCfg(ctrl: DasherCtrl, m: Mode): any {
   return {

ui/insight/src/info.js

@@ -18,7 +18,8 @@ module.exports = function(ctrl) {
       ]),
       m('p.share', ctrl.own ? m('a', {
         href: '/account/preferences/privacy',
-        target: '_blank'
+        target: '_blank',
+        rel: 'noopener',
       }, shareText) : shareText)
     ]),
     m('div.refresh', {

ui/msg/src/view/enhance.ts

@@ -34,7 +34,7 @@ const expandImage = (url: string) => /\.(jpg|jpeg|png|gif)$/.test(url) ? aImg(ur
 const expandLink = (url: string) => a(url, url.replace(/^https?:\/\//, ''));
 
 const a = (href: string, body: string) =>
-`<a target="_blank" rel="noopener" href="${(href.startsWith('/') || href.includes('://')) ? href : '//' + href}">${body}</a>`;
+`<a target="_blank" rel="noopener nofollow" href="${(href.startsWith('/') || href.includes('://')) ? href : '//' + href}">${body}</a>`;
 
 const img = (src: string) => `<img src="${src}"/>`;
 

ui/round/src/view/user.ts

@@ -37,7 +37,7 @@ export function userHtml(ctrl: RoundController, player: Player, position: Positi
         attrs: {
           'data-pt-pos': 's',
           href: '/@/' + user.username,
-          target: ctrl.isPlaying() ? '_blank' : '_self'
+          ...(ctrl.isPlaying() ? {target: '_blank', rel: 'noopener'} : {}),
         }
       }, user.title ? [
         h(

ui/swiss/src/view/playerInfo.ts

@@ -53,7 +53,7 @@ export default function(ctrl: SwissCtrl): VNode | undefined {
       h('table.pairings.sublist', {
         hook: bind('click', e => {
           const href = ((e.target as HTMLElement).parentNode as HTMLElement).getAttribute('data-href');
-          if (href) window.open(href, '_blank');
+          if (href) window.open(href, '_blank', 'noopener');
         })
       }, data.sheet.map((p, i) => {
         const round = ctrl.data.round - i;

ui/tournament/src/view/playerInfo.ts

@@ -76,7 +76,7 @@ export default function(ctrl: TournamentController): VNode {
       h('table.pairings.sublist', {
         hook: bind('click', e => {
           const href = ((e.target as HTMLElement).parentNode as HTMLElement).getAttribute('data-href');
-          if (href) window.open(href, '_blank');
+          if (href) window.open(href, '_blank', 'noopener');
         })
       }, data.pairings.map(function(p, i) {
         const res = result(p.win, p.status);