Issue Station
Sign In
Tools hereToolbox

dify - ✅(Solved) Fix fix(web): secure external form help links [1 pull requests, 1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
langgenius/dify#35691•Fetched 2026-04-30 06:45:36
View on GitHub
Comments
0
Participants
1
Timeline
1
Reactions
1
Author
princepal9120princepal9120
Participants
princepal9120princepal9120
Timeline (top)
cross-referenced ×1

Fix Action

Fixed

PR fix notes

PR #35655: fix: secure form help links

Description (problem / solution / changelog)

Summary

  • Related to #35691.
  • Adds rel="noopener noreferrer" to form help links that open with target="_blank".
  • Prevents newly opened pages from accessing window.opener.
  • Keeps existing link behavior unchanged.

Why

Links opened in a new tab should include noopener to avoid reverse-tabnabbing and opener access risks.

Validation

  • git diff --check

Changed files

  • web/app/components/base/form/components/base/base-field.tsx (modified, +1/-0)
RAW_BUFFERClick to expand / collapse

Problem

Some form help links open with target="_blank" but do not include rel="noopener noreferrer". That lets the newly opened page access window.opener, which is an avoidable reverse-tabnabbing/opener risk.

Expected behavior

External/help links that open in a new tab should include rel="noopener noreferrer" while preserving the existing link behavior.

Related PR

Related to #35655

extent analysis

TL;DR

Add rel="noopener noreferrer" to form help links that open in a new tab to prevent reverse-tabnabbing/opener risk.

Guidance

  • Identify all form help links with target="_blank" and verify if they include rel="noopener noreferrer".
  • Update the links to include rel="noopener noreferrer" while keeping the existing target="_blank" attribute.
  • Review the related PR #35655 for potential solutions or discussions on this issue.
  • Test the updated links to ensure they open in a new tab and do not expose window.opener to the newly opened page.

Example

<a href="help-link" target="_blank" rel="noopener noreferrer">Help</a>

Notes

This fix assumes that the links are generated using a template or a specific function, and updating that template or function will apply the fix to all relevant links.

Recommendation

Apply workaround by adding rel="noopener noreferrer" to the affected links, as it is a straightforward and effective way to mitigate the reverse-tabnabbing/opener risk.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

External/help links that open in a new tab should include rel="noopener noreferrer" while preserving the existing link behavior.

#task chaining#parallel task#integration issue#index setup#retrieval issue

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING