Description

This detector identifies unsafe use of target="_blank" in PHP echo statements. When links open in new windows/tabs without proper security attributes, they can be exploited through the window.opener object, allowing malicious sites to manipulate the original page or conduct phishing attacks.

Detection Strategy

• Scans PHP code for echo statements that output HTML content

• Examines the arguments passed to echo statements to identify anchor tags

• Flags echo statements that contain anchor tags with target='_blank' attribute without proper security measures

• Reports vulnerabilities when target='_blank' links lack rel='noopener' or rel='noreferrer' attributes that prevent window.opener exploitation

Vulnerable code example

<?php

// VULNERABLE: target="_blank" without rel="noopener" creates security risk
echo '<a href="https://external.com" target="_blank">Visit</a>';

// VULNERABLE: rel exists but missing noopener/noreferrer protection
echo '<a href="https://evil.com" target="_blank" rel="nofollow">Click</a>';

✅ Secure code example

<?php

// SAFE: target="_blank" with rel="noopener" prevents window.opener access
echo '<a href="https://external.com" target="_blank" rel="noopener">Visit</a>';

// SAFE: Combined nofollow with noopener for complete protection
echo '<a href="https://evil.com" target="_blank" rel="nofollow noopener">Click</a>';