AOSSIE-Org / AOSSIE-Org/Resonate-Website
Security Vulnerability & Accessibility: External links missing rel="noopener" and aria-labels
- Lingua principale
- TypeScript
- Stelle
- 43
- Fork
- 154
- Metriche di merge delle PR
- Nessuna PR unita negli ultimi 30g
Descrizione
### 🐛 Describe the bug
## Description
Several external links in [Footer.js](cci:7://file:///c:/Users/jaisw/OneDrive/Desktop/gsoc/Resonate-Website/src/components/Footer/Footer.js:0:0-0:0) and [About.js](cci:7://file:///c:/Users/jaisw/OneDrive/Desktop/gsoc/Resonate-Website/src/components/About/About.js:0:0-0:0) leverage `target="_blank"` without the accompanying `rel="noopener noreferrer"` attribute. Additionally, icon-only links (using React Icons) lack descriptive labels for screen readers.
## Vulnerability (Security)
When using `target="_blank"` without `rel="noopener noreferrer"`, the destination page receives partial access to the linking page via the `window.opener` object. This exposes the application to **reverse tabnabbing** attacks, where a malicious destination page could redirect the user's original tab to a phishing site.
## Accessibility Issue
The social media links contain only SVG icons (e.g., ``) with no text content. Screen readers will effectively be silent or announce them as "link" or "unlabeled graphic," making navigation impossible for visually impaired users.
## Locations
- [src/components/Footer/Footer.js](cci:7://file:///c:/Users/jaisw/OneDrive/Desktop/gsoc/Resonate-Website/src/components/Footer/Footer.js:0:0-0:0)
- [src/components/About/About.js](cci:7://file:///c:/Users/jaisw/OneDrive/Desktop/gsoc/Resonate-Website/src/components/About/About.js:0:0-0:0)
## Suggested Fix
1. Add `rel="noopener noreferrer"` to all external links.
2. Add `aria-label="Description"` to all icon-only anchor tags.
Guida per i contributori
Apri la guida per i contributori
Valutazione
Questa issue non è ancora stata valutata.