Is your feature request related to a problem? Please describe.
Not having the rel=noopener attribute applied to outgoing links is a potential security issue. So far, Joomla has tackled this by enforcing the attribute in various places like i.e. the WYSWIYG editor config, JHTML::link, layouts etc. - however, links generated outside of those places still depend on the user adding the attribute because it's not enforced by us. A typical example would be an article created without WYSIWYG editor support.
Describe the solution
A potential solution would be a system plugin listening to the onAfterRender event, dynamically adding the rel=noopener attribute after rendering the site.
Additional context
JSST has discussed this internally as a potential issue for 3.x, however considering the rather limitied potential securty impact and associated b/c break, we moved it to the public tracker to be discussed for Joomla 4.
Is your feature request related to a problem? Please describe.
Not having the rel=noopener attribute applied to outgoing links is a potential security issue. So far, Joomla has tackled this by enforcing the attribute in various places like i.e. the WYSWIYG editor config, JHTML::link, layouts etc. - however, links generated outside of those places still depend on the user adding the attribute because it's not enforced by us. A typical example would be an article created without WYSIWYG editor support.
Describe the solution
A potential solution would be a system plugin listening to the onAfterRender event, dynamically adding the rel=noopener attribute after rendering the site.
Additional context
JSST has discussed this internally as a potential issue for 3.x, however considering the rather limitied potential securty impact and associated b/c break, we moved it to the public tracker to be discussed for Joomla 4.