Save your links from phishers.

While Pull Request fixing issue with OWASP Tabnabbing is still open... since Feb 16, 2017, our shiny Rails applications are in danger. But wait no longer! Just put code like this:

# frozen_string_literal: true

module ActionView
  module Helpers #:nodoc:
      module UrlHelper
      # Same as #link_to, but also adds rel="nofollow" and rel="noopener" if target="_blank"
      #   rel='noopener' is added to mitigate OWASP Reverse Tabnabbing
      #
      #   external_link_to "External link", "http://www.rubyonrails.org/", target: "_blank"
      #   # => <a href="http://www.rubyonrails.org/" target="_blank" rel="nofollow noopener">External link</a>
      def external_link_to(name = nil, options = nil, html_options = nil, &block)
        html_options, options, name = options, name, yield if block_given?
        html_options ||= {}
        html_options.stringify_keys!

        html_options['rel'.freeze] = "#{html_options['rel'.freeze]} nofollow".lstrip
        html_options['rel'.freeze] = "#{html_options['rel'.freeze]} noopener".lstrip if html_options['target'.freeze] == '_blank'.freeze
        link_to(name, options, html_options)
      end
    end
  end
end

into one of initializers and enjoy bit of safety. This will add new url helper external_link_to to your disposal, that will mitigate Reverse Tabnabbing endangering your application.

Or, if you feel adventurous today... lets patch link_to itself!

# frozen_string_literal: true

module ActionView
  module Helpers #:nodoc:
    module UrlHelper

      def link_to(name = nil, options = nil, html_options = nil, &block)
        html_options, options, name = options, name, block if block_given?
        options ||= {}


        html_options = convert_options_to_data_attributes(options, html_options)

        html_options['rel'.freeze] = "#{html_options['rel'.freeze]} nofollow".lstrip
        html_options['rel'.freeze] = "#{html_options['rel'.freeze]} noopener".lstrip if html_options['target'.freeze] == '_blank'.freeze

        url = url_for(options)
        html_options["href".freeze] ||= url

        content_tag("a".freeze, name || url, html_options, &block)
      end
    end
  end
end

Even better! Now all your existing links with target="_blank" gonna be safe from nasty fishers.

Happy coding and stay safe.