Is rel="noopener" any different from rel="noopener"?

Question

I have a Wordpress tooltip plugin that converts any links in the tooltip text using special entities, so that my rel="noopener" becomes rel="noopener".

Is there any difference in terms of security in this? Do browsers correctly interpret the rel="noopener" tag? To clarify, I'm referring to a new page opened with target="_blank" being able to access my window object.

I should mention that <a href=" is also converted to <a href=" but functionality isn't lost (i.e. the link is generated normally).

Going into the plugin's innards, I noticed it generates the text using this line:

$html .= '<span class="tooltips '.$special_class.'" style="'.$style.'" title="'.htmlspecialchars(do_shortcode($content)).'">'.do_shortcode($trigger).'</span>';

Which means, HTML is generated using PHP's htmlspecialchars. According to the manual:

Certain characters have special significance in HTML, and should be represented by HTML entities if they are to preserve their meanings.

This is an example of the actual HTML output as shown on "View Source":

<p>You are basically "seeing things". That's one reason I am referring 
to it as a <span class="tooltips " style="" title="For more on this, see this 
post on the &lt;a 
href=&quot;https://plato.stanford.edu/entries/depiction/&quot; 
rel=&quot;noopener&quot; target=&quot;_blank&quot;&gt;philosophy of 
depiction&lt;/a&gt;."><span class="tooltext">philosophy of seeing</span> 
</span>.</p>

The actual output on the browser (hovering on the tooltip) looks like this. The link works and opens in a new tab.

I also looked at these two questions, but they don't seem to be directly relevant to my question:

• XSS to overcome HTML entities
• Are HTML Entities inherently unsafe?

Answer 1

If you look at the HTML output, the HTML for the tooltip is inside the title attribute of the the element the tooltip is applied to. That means that quotes and tags has to be HTML-encoded. If they were not, they could not be contained within a HTML attribute.

If you look at the picture, the content of the title attribute has somehow been turned into a real part of the page, and not just a title text. That magic is probably done by some JavaScript from the Wordpress plugin. I can't say for sure what that plugin does, but I am fairly certain that if you use the inspector in the development console to take a look at the link inside the tooltip it will indeed have rel="noopener".

So I don't think there is anything to be worried about here.