检查 HTML 和 JSX 中在新标签页打开的链接，补全缺失的 rel 属性值，并说明如何防止目标页面操控原标签页，以及如何控制发送的来源信息。
Use when reviewing HTML or JSX for anchor elements with target='_blank' to verify rel='noopener noreferrer' is present.
检查 HTML 和 JSX 中在新标签页打开的链接是否安全。查找带有 target="_blank" 的链接，确认是否包含 rel="noopener noreferrer"，或至少包含 noopener，并协助补全缺失值。还会解释新打开的页面如何将原标签页重定向到虚假登录页面，以及相关属性如何阻止这种攻击。
适合在发布含有外部链接的页面前检查，也适合审查 React 中的链接实现。需要理解添加这些属性的原因，并考虑通过 ESLint 配置避免再次遗漏时，可以使用此技能。
rel 属性值。”noopener 与 noreferrer 的区别。”noopener 阻止新打开的页面访问原标签页；noreferrer 还会抑制发送给目标网站的来源信息。资料考虑到旧版浏览器等情况，采用明确写出属性的做法。修改时应区分两者的作用。
本介绍由 AI（OpenAI Codex）根据公开的 SKILL.md 撰写。准确的规格请查看下方原文。
AI 仅根据 SKILL.md 的内容，从 4 个方面进行了评估。星标数和热度不计入评估。
总分按每项 A=25 分、B=15 分、C=5 分相加。 由 AI（OpenAI Codex）于 2026年10月23日 评估。仅供参考，安装前请同时查看原文。
安装前可以查看交给 AI 代理的指令内容。
A malicious site opened via target='_blank' can use window.opener.location to silently redirect your original tab to a phishing page — the user switches back and sees a fake login screen on what appears to be your domain.
rel="noopener noreferrer" to any <a target="_blank"> linknoopener prevents the new tab from accessing window.opener and redirecting your pagenoreferrer additionally suppresses the Referer header sent to the destination sitenoopener for cross-origin _blank links, but explicit markup is required for older browsers and same-origin linksjsx-a11y/anchor-is-valid and eslint-plugin-security can enforce this automaticallyFind all anchor elements with target='_blank' in the HTML and JSX source. Verify each one includes rel='noopener noreferrer' (or at minimum rel='noopener'). Flag any external links opening in a new tab that are missing this attribute.
Add rel='noopener noreferrer' to all <a target='_blank'> elements. In React/JSX this is rel="noopener noreferrer". Configure an ESLint rule to prevent this from recurring.
Explain the reverse tabnapping attack enabled by window.opener, how rel='noopener' and rel='noreferrer' prevent it, and the difference between the two values.
Review server config, headers, forms, and integration points related to External Link Security. Flag exact responses, cookies, or browser behaviors that violate the rule, and verify them against the effective production-like response.
For full implementation details, code examples, and framework-specific guidance,
see references/rule.md.
Rule page: https://frontendchecklist.io/rules/security/new-tab
还没有评价。欢迎分享你的使用感受。
无需登录即可发表。欢迎分享使用感受、提问，或说明在哪些环境下无法运行。
还没有评论。来写第一条吧。
Create and review custom 404 pages that help visitors recover from broken or moved links through search and navigation. Check the rendered page and HTTP response so missing content returns a proper 404 status.
中文简介正在准备中。当前显示英语简介。
Audit or create a dedicated About page that explains a website’s purpose and identifies its people or organization. Review the rendered output and supporting information, including expertise and contact details, to find gaps.
中文简介正在准备中。当前显示英语简介。
为页面和共用组件添加自动无障碍测试，检查现有测试的覆盖缺口，并将检查接入持续集成流程，以发现结构、属性问题及修改引入的新问题。
检查从登录、多因素认证到账户恢复的完整流程，找出禁止粘贴、验证码必须手动输入等使用障碍，并协助改进认证方式。
Review form errors, success messages, and live updates so screen reader users receive important notifications. Check the HTML delivered to the browser, announcement settings, display duration, and dismissal controls, then identify specific elements that need changes.
中文简介正在准备中。当前显示英语简介。
Review HTML tables so screen reader users can understand how headers and data relate. Check header markup, table descriptions, and merged cells, then identify specific fixes and ways to verify them.
中文简介正在准备中。当前显示英语简介。