furyhawk/deer-flow
1
0
Fork 0
mirror of https://github.com/bytedance/deer-flow.git synced 2026-06-10 09:25:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(frontend): resolve invalid HTML nesting and tabnabbing vulnerabilities (#1904)

Browse Source 
* fix(frontend): resolve invalid HTML nesting and tabnabbing vulnerabilities

Fix `<button>` inside `<a>` invalid HTML in artifact components and add
missing `noopener,noreferrer` to `window.open` calls to prevent reverse
tabnabbing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(frontend): address Copilot review on tabnabbing and double-tab-open

Remove redundant parent onClick on web_fetch ChainOfThoughtStep to
prevent opening two tabs on link click, and explicitly null out
window.opener after window.open() for defensive tabnabbing hardening.

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
yangzheli
2026-04-07 09:44:17 +08:00
committed by GitHub
parent 2d068cc075
commit 3acdf79beb
3 changed files with 45 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/src/components/workspace/artifacts/artifact-file-detail.tsx
+26 -22
View File
@@ -188,17 +188,19 @@ export function ArtifactFileDetail({
</Tooltip>
)}
{!isWriteFile && (
<a
href={urlOfArtifact({ filepath, threadId })}
target="_blank"
rel="noopener noreferrer"
>
<ArtifactAction
icon={SquareArrowOutUpRightIcon}
label={t.common.openInNewWindow}
tooltip={t.common.openInNewWindow}
/>
</a>
<ArtifactAction
icon={SquareArrowOutUpRightIcon}
label={t.common.openInNewWindow}
tooltip={t.common.openInNewWindow}
onClick={() => {
const w = window.open(
urlOfArtifact({ filepath, threadId }),
"_blank",
"noopener,noreferrer",
);
if (w) w.opener = null;
}}
/>
)}
{isCodeFile && (
<ArtifactAction
@@ -218,17 +220,19 @@ export function ArtifactFileDetail({
/>
)}
{!isWriteFile && (
<a
href={urlOfArtifact({ filepath, threadId, download: true })}
target="_blank"
rel="noopener noreferrer"
>
<ArtifactAction
icon={DownloadIcon}
label={t.common.download}
tooltip={t.common.download}
/>
</a>
<ArtifactAction
icon={DownloadIcon}
label={t.common.download}
tooltip={t.common.download}
onClick={() => {
const w = window.open(
urlOfArtifact({ filepath, threadId, download: true }),
"_blank",
"noopener,noreferrer",
);
if (w) w.opener = null;
}}
/>
)}
<ArtifactAction
icon={XIcon}