Description

Detects potential reverse tabnabbing vulnerabilities in JavaScript code where window.open() is used without proper security attributes. Reverse tabnabbing allows an opened page to manipulate its opener window, which could enable phishing attacks where the parent page is redirected to a malicious site.

Detection Strategy

• Identifies calls to window.open() in JavaScript code

• Reports a vulnerability if window.open() is used without setting noopener/noreferrer attributes or if opener access is not explicitly disabled

• Examines all instances where new windows or tabs are opened through window.open() API calls

• Considers the context of how the opened window is configured for potential opener manipulation risks

Vulnerable code example

// External URL that could be malicious
const externalURL = "https://external-site.com";

function unsafeWindowOpening() {
    // Vulnerable: Opens external URL without noopener protection
    window.open("https://external-site.com", "_blank");
    
    // Vulnerable: Uses variable URL without security parameters...

✅ Secure code example

// External URL that could be malicious
const externalURL = "https://external-site.com";

function safeWindowOpening() {
    // Safe: Uses both noopener and noreferrer to prevent opener exploitation
    window.open("https://external-site.com", "_blank", "noopener,noreferrer");
    
    // Safe: Variable URL with required security attributes...