fix: ignore plugin-supplied target in ui.openExternalUrl to block host-frame hijack

2026-05-18 16:18:00 +02:00
parent 3ceada7b8a
commit 400703154e
1 changed files with 3 additions and 2 deletions
@@ -296,8 +296,9 @@ export async function dispatchApiCall(
      if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
        throw new Error(`ui.openExternalUrl: ${parsed.protocol} not allowed`);
      }
-      const target = typeof args[1] === 'string' ? (args[1] as string) : '_blank';
-      window.open(parsed.toString(), target, 'noopener,noreferrer');
+      // Always open in a new tab; plugins must not be able to navigate the
+      // host window (_self/_top/_parent) to an attacker-controlled origin.
+      window.open(parsed.toString(), '_blank', 'noopener,noreferrer');
      return undefined;
    }