security: add rel="noopener noreferrer" to external links

Prevents reverse tabnabbing attacks on target="_blank" links.

.jules/sentinel.md

@@ -0,0 +1,4 @@
+## 2024-05-22 - Reverse Tabnabbing Vulnerability
+**Vulnerability:** External links with `target="_blank"` allow the opened page to access the `window.opener` object, potentially enabling the new page to redirect the original page (Reverse Tabnabbing).
+**Learning:** Even internal tool links (like "GitHub") can be a vector if the destination is compromised or if it redirects. Always treat `target="_blank"` as unsafe.
+**Prevention:** Enforce `rel="noopener noreferrer"` on all `target="_blank"` links.

js/christmas-sidebar.js

@@ -450,7 +450,8 @@ function renderSidebar(elRoot) {
   const footer = el("div", { className: "christmas-footer" }, [
     el("a", {
       href: "https://github.com/AEmotionStudio/ComfyUI-ChristmasTheme",
-      target: "_blank"
+      target: "_blank",
+      rel: "noopener noreferrer"
     }, ["🎁 GitHub"])
   ]);
   const container = el("div", { className: "christmas-sidebar" }, [

src/christmas-sidebar.ts

@@ -572,7 +572,8 @@ function renderSidebar(elRoot: HTMLElement): void {
     const footer = el('div', { className: 'christmas-footer' }, [
         el('a', {
             href: "https://github.com/AEmotionStudio/ComfyUI-ChristmasTheme",
-            target: "_blank"
+            target: "_blank",
+            rel: "noopener noreferrer"
         }, ["🎁 GitHub"])
     ]);