fix(security): mitigating a few frontend security issues

bcgov · Jul 5, 2023 · fe3145c · fe3145c
1 parent eff27b1
commit fe3145c
Show file tree

Hide file tree

Showing 3 changed files with 20 additions and 7 deletions.
diff --git a/frontend/src/components/wizard/WizardProgressIndicatorComponent.vue b/frontend/src/components/wizard/WizardProgressIndicatorComponent.vue
@@ -19,8 +19,8 @@
         <p>
           <a
             v-if="canShowLink(step)"
-            :href="'#' + index"
             @click.prevent="emit('go-to', index)"
+            rel="noopener noreferrer"
             >{{ step.title }}</a
           >
           <span

diff --git a/frontend/src/pages/ApplyClientNumberPage.vue b/frontend/src/pages/ApplyClientNumberPage.vue
@@ -78,9 +78,14 @@
             <p class="inner-text inner-text-spaced">
               Your first name, last name and email address are from your BCeID.
               If they're incorrect,
-              <a href="https://bceid.ca" target="_blank">go to BCeID</a> to
-              update them before submitting your form. Be sure to add your phone
-              number, location and role.
+              <a
+                href="https://bceid.ca"
+                target="_blank"
+                rel="noopener noreferrer"
+                >go to BCeID</a
+              >
+              to update them before submitting your form. Be sure to add your
+              phone number, location and role.
             </p>
             <p class="inner-text inner-text-spaced">
               To add another contact to the account, select "Add another

diff --git a/frontend/src/pages/applyform/BusinessInformationWizardStep.vue b/frontend/src/pages/applyform/BusinessInformationWizardStep.vue
@@ -236,8 +236,13 @@ watch([selectedOption], () => {
         <ol type="1" class="bulleted-list">
           <li>
             Log into Manage Account in
-            <a href="https://www.bceid.ca/" target="_blank">BCeID</a> to find
-            your business name
+            <a
+              href="https://www.bceid.ca/"
+              target="_blank"
+              rel="noopener noreferrer"
+              >BCeID</a
+            >
+            to find your business name
           </li>
           <li>
             If your name isn’t there, call BC Registry toll free at
@@ -257,7 +262,10 @@ watch([selectedOption], () => {
         Your request for a client number cannot go ahead because “{{
           formData.businessInformation.businessName
         }}” is not in good standing with BC Registries. Go to your
-        <a href="https://www.bcregistry.gov.bc.ca/" target="_blank"
+        <a
+          href="https://www.bcregistry.gov.bc.ca/"
+          target="_blank"
+          rel="noopener noreferrer"
           >BC Registries</a
         >
         account to find out why.