From 74e23b2e2b36fb8b1d12cb2ca6b83f91e37417ba Mon Sep 17 00:00:00 2001
From: Samuel Degueldre <sad@odoo.com>
Date: Mon, 30 Sep 2019 06:34:25 +0000
Subject: [PATCH] [IMP] Prevent reverse tabnabbing in plaintext2html, linkify,
 _makeLink

These functions convert plain text links into clickable hyperlinks.
These open in new tabs but did not have the "noreferrer noopener" rel
attributes, which made them susceptible to reverse tabnabbing.

A lot of attack vectors were available to unregistered, uninvited
anonymous users and presented a significant phishing threat (such as
posting links in the instant-chat, through a mail-alias, in a forum post
or in a twitter post) and leading the operator to believe he had been
disconnected from odoo in the original tab, prompting them to enter
their credentials.

while these three places will add the noreferrer and noopener attributes
on the anchor tags generated by them, there are still many places that
create hyperlinks without the use of these functions, although most of
them are static links, they still represent a transitive security
vulnerability to the linked sites.

There are also a few modules and widgets that roll out their own links
or open new tabs unsafely using window.open(), these will need to be
patched separately.

closes odoo/odoo#37591

Signed-off-by: Olivier Dony (odo) <odo@openerp.com>
---
 addons/mail/static/src/js/utils.js                             | 3 +++
 .../website_twitter/static/src/js/website.twitter.animation.js | 1 +
 odoo/tools/mail.py                                             | 2 +-
 3 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/addons/mail/static/src/js/utils.js b/addons/mail/static/src/js/utils.js
index 25e327b0428..4c9fdd8d20e 100644
--- a/addons/mail/static/src/js/utils.js
+++ b/addons/mail/static/src/js/utils.js
@@ -33,6 +33,9 @@ function linkify(text, attrs) {
     if (attrs.target === undefined) {
         attrs.target = '_blank';
     }
+    if (attrs.target === '_blank') {
+      attrs.rel = 'noreferrer noopener';
+    }
     attrs = _.map(attrs, function (value, key) {
         return key + '="' + _.escape(value) + '"';
     }).join(' ');
diff --git a/addons/website_twitter/static/src/js/website.twitter.animation.js b/addons/website_twitter/static/src/js/website.twitter.animation.js
index 3bea076d7bd..295ae199868 100644
--- a/addons/website_twitter/static/src/js/website.twitter.animation.js
+++ b/addons/website_twitter/static/src/js/website.twitter.animation.js
@@ -74,6 +74,7 @@ publicWidget.registry.twitter = publicWidget.Widget.extend({
                         text: text,
                         href: url,
                         target: '_blank',
+                        rel: 'noreferrer noopener',
                     });
                     return c.prop('outerHTML');
                 }
diff --git a/odoo/tools/mail.py b/odoo/tools/mail.py
index f9a5cfa67cf..aa2552f8356 100644
--- a/odoo/tools/mail.py
+++ b/odoo/tools/mail.py
@@ -261,7 +261,7 @@ def html_keep_url(text):
     link_tags = re.compile(r"""(?<!["'])((ftp|http|https):\/\/(\w+:{0,1}\w*@)?([^\s<"']+)(:[0-9]+)?(\/|\/([^\s<"']))?)(?![^\s<"']*["']|[^\s<"']*</a>)""")
     for item in re.finditer(link_tags, text):
         final += text[idx:item.start()]
-        final += '<a href="%s" target="_blank">%s</a>' % (item.group(0), item.group(0))
+        final += '<a href="%s" target="_blank" rel="noreferrer noopener">%s</a>' % (item.group(0), item.group(0))
         idx = item.end()
     final += text[idx:]
     return final