From d9be0207bbcff787cbabf7b28ee2f56f727dade9 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Wed, 14 Jan 2026 19:36:15 +0000
Subject: [PATCH] security: add rel="noopener noreferrer" to external links

Prevents reverse tabnabbing attacks on target="_blank" links.
---
 .jules/sentinel.md       | 4 ++++
 js/christmas-sidebar.js  | 3 ++-
 src/christmas-sidebar.ts | 3 ++-
 3 files changed, 8 insertions(+), 2 deletions(-)
 create mode 100644 .jules/sentinel.md

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
new file mode 100644
index 0000000..c5e398c
--- /dev/null
+++ b/.jules/sentinel.md
@@ -0,0 +1,4 @@
+## 2024-05-22 - Reverse Tabnabbing Vulnerability
+**Vulnerability:** External links with `target="_blank"` allow the opened page to access the `window.opener` object, potentially enabling the new page to redirect the original page (Reverse Tabnabbing).
+**Learning:** Even internal tool links (like "GitHub") can be a vector if the destination is compromised or if it redirects. Always treat `target="_blank"` as unsafe.
+**Prevention:** Enforce `rel="noopener noreferrer"` on all `target="_blank"` links.
diff --git a/js/christmas-sidebar.js b/js/christmas-sidebar.js
index 484fb94..42c71ad 100644
--- a/js/christmas-sidebar.js
+++ b/js/christmas-sidebar.js
@@ -450,7 +450,8 @@ function renderSidebar(elRoot) {
   const footer = el("div", { className: "christmas-footer" }, [
     el("a", {
       href: "https://github.com/AEmotionStudio/ComfyUI-ChristmasTheme",
-      target: "_blank"
+      target: "_blank",
+      rel: "noopener noreferrer"
     }, ["🎁 GitHub"])
   ]);
   const container = el("div", { className: "christmas-sidebar" }, [
diff --git a/src/christmas-sidebar.ts b/src/christmas-sidebar.ts
index 9b931ad..06eec88 100644
--- a/src/christmas-sidebar.ts
+++ b/src/christmas-sidebar.ts
@@ -572,7 +572,8 @@ function renderSidebar(elRoot: HTMLElement): void {
     const footer = el('div', { className: 'christmas-footer' }, [
         el('a', {
             href: "https://github.com/AEmotionStudio/ComfyUI-ChristmasTheme",
-            target: "_blank"
+            target: "_blank",
+            rel: "noopener noreferrer"
         }, ["🎁 GitHub"])
     ]);