Potential security vulnerability when using the Telerik RadEditor

[Евгений]

Hi guys,

One of the options of the RadEditor is an option to create links using UI (see the attached screenshot RedEditorVulnerability.jpg)

Here is an option to open a new tab when clicking this link on a front-end site.

What I've recently found is this article with an example https://dev.to/ben/the-targetblank-vulnerability-by-example which says that using the "target=_blank" is a potential security hole for any site in any browser for now. Also there are some suggestions regarding on how to prevent this (by adding the rel="noopener noreferrer" attribute to a link).

So I'd like to ask you to add a possibility in the Hyperlink Manager to secure such links (e.g. some kind of checkbox "Protect my link from the target=_blank vulnerability").

This functionality will be very helpful for those clients who are focused on their sites' security.

Thank you!

 

[Ianko]

Hello,

Thank you for the useful feedback. Typically, the proper channel to suggest features and improvements is our feedback portal: http://feedback.telerik.com/Project/108/. 

I can agree at some extent that such a feature would be nice. However, it is rather the developer's responsibility to make sure that such security vulnerabilities are handled properly. The RadEditor, as a component, can enable you to further tweak it so to have always these attributes in the anchor tags.

This should be programmatically achieved using client-side and/or server-side code to ensure that the rel attribute is configured as per to the application's security requirements. Having options for that in the Hyperlink Manager could cause unneeded confusion among end users that does not have so advanced knowledge on HTML and the security vulnerabilities of this attribute. 

Here you are some possible options to handle the case:

• Using a custom content filter in order to assure that the submitted HTML includes <a> tags with the needed rel values: http://demos.telerik.com/aspnet-ajax/editor/examples/contentfilters/defaultcs.aspx. Additionally, make sure to proceed the HTML content on the server by using similar server-side logic in order to reassure the HTML correctness. 
  
  
• Using the OnClientDomChange event to change the <a> tags on the fly (just after being created via the Hyperlink Manager): http://docs.telerik.com/devtools/aspnet-ajax/controls/editor/client-side-programming/events/onclientdomchange. 
  
  
• You can also change the UI of the dialog in order to remove the _blank option or even better, add an additional option for the rel attribute: http://demos.telerik.com/aspnet-ajax/editor/examples/externaldialogspath/defaultcs.aspx. 

If you have any further concerns, ideas or suggestions, please make sure to post them in our feedback portal with further technical details so that the dev team can evaluate them and consider them for the roadmap of RadEditor.

Regards,
Ianko
Telerik by Progress