You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
2021 update: Browsers now implicitly set rel=noopener for any target=_blank link, following a spec change. If the demo on this page no longer seems scary, congratulations — you’re using a modern browser!
So the cop should be disabled.
The text was updated successfully, but these errors were encountered:
I don't think we should be encouraging developers to litter their code with rel=noopener to make it safer for users running three years old browsers. Those users with so old browsers have a ton of remote code execution bugs in their browsers, so whether or not rel=noopener is there, won't make a big difference to them.
There no doubt that users with old browser have a plethora of issues and really should update. For me there are still a good chunk that don't do that for one reason or another. I can't tell what the consequences would be for those if this is disabled. If it does anything at all I'd prefer to keep it.
That's just my personal opinion, I don't know when a good point would be to disable this. Maybe now, maybe a year ago already, or just 5 years in the future. 🤷
This is only a vulnerability in over three years old browsers.
rubocop-rails/config/default.yml
Line 653 in 202d8c1
From https://mathiasbynens.github.io/rel-noopener/
So the cop should be disabled.
The text was updated successfully, but these errors were encountered: