From b502e4dadb3172ca929e9d584de5ce81022004e2 Mon Sep 17 00:00:00 2001
From: Lorenz Baum <lorenzbaum@gmx.de>
Date: Thu, 9 Apr 2026 01:54:31 +0200
Subject: [PATCH] Fix rel="noopener noreferrer" for external _blank links to
 improve security (reverse-tabnabbing)

---
 src/app/(dashboard)/control-center/page.tsx    |  2 +-
 src/components/DropdownMenu.tsx                | 12 +++++++++++-
 src/components/InlineLink.tsx                  | 18 ++++++++++++++++--
 src/components/SidebarItem.tsx                 |  2 +-
 src/components/ui/HelpAndSupportButton.tsx     |  5 -----
 src/modules/onboarding/OnboardingEnd.tsx       |  1 +
 src/modules/setup-netbird-modal/AndroidTab.tsx |  1 +
 src/modules/setup-netbird-modal/DockerTab.tsx  |  1 +
 src/modules/setup-netbird-modal/IOSTab.tsx     |  1 +
 src/modules/setup-netbird-modal/MacOSTab.tsx   |  8 +++++++-
 10 files changed, 40 insertions(+), 11 deletions(-)

diff --git a/src/app/(dashboard)/control-center/page.tsx b/src/app/(dashboard)/control-center/page.tsx
index d4aa5591..5e0e0dae 100644
--- a/src/app/(dashboard)/control-center/page.tsx
+++ b/src/app/(dashboard)/control-center/page.tsx
@@ -1843,7 +1843,7 @@ function ControlCenterView() {
 
         <div className={"absolute right-0 bottom-0 z-10"}>
           <div className={"px-6 py-4"}>
-            <a href={"https://forms.gle/MKJnVXCiUM1KtxLy6"} target={"_blank"}>
+            <a href={"https://forms.gle/MKJnVXCiUM1KtxLy6"} target={"_blank"} rel="noopener noreferrer">
               <Button variant={"secondary"} size={"xs"}>
                 <MessageSquareShareIcon size={12} />
                 Feedback
diff --git a/src/components/DropdownMenu.tsx b/src/components/DropdownMenu.tsx
index 5fa0a820..b9eb94ad 100644
--- a/src/components/DropdownMenu.tsx
+++ b/src/components/DropdownMenu.tsx
@@ -111,6 +111,16 @@ const DropdownMenuItem = React.forwardRef<
     },
     ref,
   ) => {
+    const safeRel = React.useMemo(() => {
+      if (target !== "_blank") return rel;
+
+      const tokens = new Set((rel ?? "").split(/\s+/).filter(Boolean));
+      tokens.add("noopener");
+      tokens.add("noreferrer");
+
+      return Array.from(tokens).join(" ");
+    }, [target, rel]);
+
     return (
       <DropdownMenuPrimitive.Item
         ref={ref}
@@ -130,7 +140,7 @@ const DropdownMenuItem = React.forwardRef<
         {...props}
       >
         {href ? (
-          <a href={href} target={target} rel={rel}>
+          <a href={href} target={target} rel={safeRel}>
             {props.children}
           </a>
         ) : (
diff --git a/src/components/InlineLink.tsx b/src/components/InlineLink.tsx
index 1b837381..25395423 100644
--- a/src/components/InlineLink.tsx
+++ b/src/components/InlineLink.tsx
@@ -9,6 +9,7 @@ interface Props extends LinkProps, InlineLinkProps {
   children: React.ReactNode;
   className?: string;
   target?: "_blank" | "_self" | "_parent" | "_top";
+  rel?: string;
 }
 
 interface InlineButtonProps
@@ -16,7 +17,6 @@ interface InlineButtonProps
     InlineLinkProps {
   children: React.ReactNode;
   className?: string;
-  target?: "_blank" | "_self" | "_parent" | "_top";
 }
 
 export const linkVariants = cva(
@@ -35,8 +35,22 @@ export const linkVariants = cva(
 );
 
 export default function InlineLink({ variant = "default", ...props }: Props) {
+  const safeRel = React.useMemo(() => {
+    if (props.target !== "_blank") return props.rel;
+
+    const tokens = new Set((props.rel ?? "").split(/\s+/).filter(Boolean));
+    tokens.add("noopener");
+    tokens.add("noreferrer");
+
+    return Array.from(tokens).join(" ");
+  }, [props.target, props.rel]);
+
   return (
-    <Link {...props} className={cn(props.className, linkVariants({ variant }))}>
+    <Link
+      {...props}
+      rel={safeRel}
+      className={cn(props.className, linkVariants({ variant }))}
+    >
       {props.children}
     </Link>
   );
diff --git a/src/components/SidebarItem.tsx b/src/components/SidebarItem.tsx
index 7656436f..9b5c5b25 100644
--- a/src/components/SidebarItem.tsx
+++ b/src/components/SidebarItem.tsx
@@ -66,7 +66,7 @@ export default function SidebarItem({
     if (collapsible && mobileNavOpen) return;
     if (collapsible && open) return;
     if (preventRedirect) return;
-    if (target == "_blank") return window.open(href, "_blank");
+    if (target == "_blank") return window.open(href, "_blank", "noopener,noreferrer");
     if (mobileNavOpen) toggleMobileNav();
     router.push(href);
   };
diff --git a/src/components/ui/HelpAndSupportButton.tsx b/src/components/ui/HelpAndSupportButton.tsx
index f6426ee2..4a1758d9 100644
--- a/src/components/ui/HelpAndSupportButton.tsx
+++ b/src/components/ui/HelpAndSupportButton.tsx
@@ -57,7 +57,6 @@ export default function HelpAndSupportButton() {
         <DropdownMenuItem
           href="https://docs.netbird.io/"
           target="_blank"
-          rel="noopener noreferrer"
           asChild
         >
           <div className={"flex gap-3 items-center"}>
@@ -71,7 +70,6 @@ export default function HelpAndSupportButton() {
         <DropdownMenuItem
           href="https://docs.netbird.io/help/troubleshooting-client"
           target="_blank"
-          rel="noopener noreferrer"
           asChild
         >
           <div className={"flex gap-3 items-center"}>
@@ -97,7 +95,6 @@ export default function HelpAndSupportButton() {
         <DropdownMenuItem
           href="https://forum.netbird.io/"
           target="_blank"
-          rel="noopener noreferrer"
           asChild
         >
           <div className={"flex gap-3 items-center"}>
@@ -111,7 +108,6 @@ export default function HelpAndSupportButton() {
         <DropdownMenuItem
           href="https://docs.netbird.io/slack-url"
           target="_blank"
-          rel="noopener noreferrer"
           asChild
         >
           <div className={"flex gap-3 items-center"}>
@@ -128,7 +124,6 @@ export default function HelpAndSupportButton() {
         <DropdownMenuItem
           href={"https://forms.gle/TeLw2zrXEdw6RcQ36"}
           target={"_blank"}
-          rel="noopener noreferrer"
           asChild
         >
           <div className={"flex gap-3 items-center"}>
diff --git a/src/modules/onboarding/OnboardingEnd.tsx b/src/modules/onboarding/OnboardingEnd.tsx
index 8b39a973..a32dda19 100644
--- a/src/modules/onboarding/OnboardingEnd.tsx
+++ b/src/modules/onboarding/OnboardingEnd.tsx
@@ -97,6 +97,7 @@ const VideoGuide = ({
           "border border-nb-gray-900 rounded-lg p-[2px] bg-nb-gray-920 min-w-[160px] max-w-[160px] relative group hover:bg-nb-gray-900 transition-all"
         }
         target={"_blank"}
+        rel="noopener noreferrer"
         href={href}
       >
         <span
diff --git a/src/modules/setup-netbird-modal/AndroidTab.tsx b/src/modules/setup-netbird-modal/AndroidTab.tsx
index 09e52612..c90ae42a 100644
--- a/src/modules/setup-netbird-modal/AndroidTab.tsx
+++ b/src/modules/setup-netbird-modal/AndroidTab.tsx
@@ -26,6 +26,7 @@ export default function AndroidTab() {
                   "https://play.google.com/store/apps/details?id=io.netbird.client"
                 }
                 target={"_blank"}
+                rel="noopener noreferrer"
               >
                 <Image
                   src={GooglePlayButton}
diff --git a/src/modules/setup-netbird-modal/DockerTab.tsx b/src/modules/setup-netbird-modal/DockerTab.tsx
index 166f98f2..eb8243b5 100644
--- a/src/modules/setup-netbird-modal/DockerTab.tsx
+++ b/src/modules/setup-netbird-modal/DockerTab.tsx
@@ -37,6 +37,7 @@ export default function DockerTab({
                 href={"https://docs.docker.com/engine/install/"}
                 passHref
                 target={"_blank"}
+                rel="noopener noreferrer"
               >
                 <Button variant={"primary"}>
                   <ExternalLinkIcon size={14} />
diff --git a/src/modules/setup-netbird-modal/IOSTab.tsx b/src/modules/setup-netbird-modal/IOSTab.tsx
index 09a1f725..4f842ede 100644
--- a/src/modules/setup-netbird-modal/IOSTab.tsx
+++ b/src/modules/setup-netbird-modal/IOSTab.tsx
@@ -24,6 +24,7 @@ export default function IOSTab() {
               <Link
                 href={"https://apps.apple.com/app/netbird-p2p-vpn/id6469329339"}
                 target={"_blank"}
+                rel="noopener noreferrer"
               >
                 <Image
                   src={AppStoreButton}
diff --git a/src/modules/setup-netbird-modal/MacOSTab.tsx b/src/modules/setup-netbird-modal/MacOSTab.tsx
index f6584c05..d4ba7330 100644
--- a/src/modules/setup-netbird-modal/MacOSTab.tsx
+++ b/src/modules/setup-netbird-modal/MacOSTab.tsx
@@ -53,6 +53,7 @@ export default function MacOSTab({
                 href={"https://pkgs.netbird.io/macos/universal"}
                 passHref
                 target={"_blank"}
+                rel="noopener noreferrer"
               >
                 <Button variant={"primary"}>
                   <DownloadIcon size={14} />
@@ -148,7 +149,12 @@ export default function MacOSTab({
                 <Steps.Step step={1}>
                   <p>Download and install HomeBrew</p>
                   <div className={"flex gap-4"}>
-                    <Link href={"https://brew.sh/"} passHref target={"_blank"}>
+                    <Link
+                      href={"https://brew.sh/"}
+                      passHref
+                      target={"_blank"}
+                      rel="noopener noreferrer"
+                    >
                       <Button variant={"primary"}>
                         <ExternalLinkIcon size={14} />
                         HomeBrew Installation Guide