🛡️ Sentinel: [MEDIUM] Fix reverse tabnabbing on external links

[NickJLange]

🚨 Severity: MEDIUM

💡 Vulnerability: External links created dynamically in HomepageContent/index.js did not explicitly set target="_blank" or rel="noopener noreferrer". This could allow the newly opened external site to access the window.opener object, potentially leading to a reverse tabnabbing attack where the attacker changes the original page to a phishing site. Additionally, omitting noreferrer leaked referer information to external sites.

🎯 Impact: Potential phishing via malicious redirects on the original tab, and minor privacy leakage via the Referer header.

🔧 Fix: Updated the Link component generation logic to conditionally evaluate the isExternal boolean and apply target="_blank" and rel="noopener noreferrer" accordingly.

✅ Verification: Verified that external links in the Homepage Content now render with target="_blank" rel="noopener noreferrer" via a Playwright test. Also verified the build succeeds and no regressions were introduced. Added learning to .jules/sentinel.md.

---

PR created automatically by Jules for task 9481431023995986913 started by @NickJLange

---

Summary by cubic

Fixes reverse tabnabbing by setting safe attributes on external links in the homepage. Prevents opener access and referer leaks when opening external sites.

• Bug Fixes
  • In src/components/HomepageContent/index.js, apply target="_blank" and rel="noopener noreferrer" when isExternal is true; internal links remain unchanged.
  • Added a security note to .jules/sentinel.md documenting the issue and prevention.

^{Written for commit 7bc7274. Summary will update on new commits.}

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[cubic-dev-ai]

No issues found across 2 files