I have a Wordpress tooltip plugin that converts any links in the tooltip text using special entities, so that my rel="noopener"
becomes rel="noopener"
.
Is there any difference in terms of security in this? Do browsers correctly interpret the rel="noopener"
tag? To clarify, I'm referring to a new page opened with target="_blank"
being able to access my window
object.
I should mention that <a href="
is also converted to <a href="
but functionality isn't lost (i.e. the link is generated normally).
Going into the plugin's innards, I noticed it generates the text using this line:
$html .= '<span class="tooltips '.$special_class.'" style="'.$style.'" title="'.htmlspecialchars(do_shortcode($content)).'">'.do_shortcode($trigger).'</span>';
Which means, HTML is generated using PHP's htmlspecialchars
. According to the manual:
Certain characters have special significance in HTML, and should be represented by HTML entities if they are to preserve their meanings.
This is an example of the actual HTML output as shown on "View Source":
<p>You are basically "seeing things". That's one reason I am referring
to it as a <span class="tooltips " style="" title="For more on this, see this
post on the <a
href="https://plato.stanford.edu/entries/depiction/"
rel="noopener" target="_blank">philosophy of
depiction</a>."><span class="tooltext">philosophy of seeing</span>
</span>.</p>
The actual output on the browser (hovering on the tooltip) looks like this. The link works and opens in a new tab.
I also looked at these two questions, but they don't seem to be directly relevant to my question: