Fixing all target=“_blank” vulnerabilities in a website

Question

https://dev.to/ben/the-targetblank-vulnerability-by-example

I've been reading more about this lately and would like to make sure my website(s) are secure. I assume a simple search and replace should fix the issue but though I'd come to the community to check.

I know I have used this string of code in my CMS Pages and possibly Static Blocks as well. It is probably peppered into some custom .html and .phtml pages in my design folders too. Since I can use Dreamweaver on a copy of my site to update the .(p)html files, how can I use phpMyAdmin to update the strings controlled by magento?

I'd like to change the following string from this:

target="_blank"

To this:

target="_blank" rel="noopener noreferrer"

In all CMS Pages, Static Blocks, Product Descriptions, and Short Descriptions (catalog_product_entity_text & catalog_product_flat_#) - as that is where a search is showing the most results.

Are there any issues I should be aware of? Anyone else reading this should follow the golden rule of always making a DB backup before applying any changes like this.

Thanks!

Answer 1

First, identifiy the tables and columns you need to change:

• cms_page.content
• cms_block.content
• catalog_product_entity_text.value
• catalog_category_entity_text.value
• (and maybe more?)

(no need to update the index tables like the flat catalog manually, better rebuild the indexes afterwards)

Then run an SQL query for each, like this:

UPDATE cms_page SET content = REPLACE(content, 'target="_blank"', 'target="_blank" rel="noopener noreferrer"');
       ^^^^^^^^     ^^^^^^^           ^^^^^^^
        table       column            column