Merge branch 'greg-add-noopener-noreferrer-to-links' into 'master'

Adds noopener noreferrer to target="_blank" links

See merge request gitlab-org/gitlab!74947

app/views/admin/application_settings/_account_and_limit.html.haml

@@ -52,8 +52,7 @@
       = f.text_field :user_default_internal_regex, placeholder: _('Regex pattern'), class: 'form-control gl-form-input gl-mt-2'
       .help-block
         = _('Specify an email address regex pattern to identify default internal users.')
-        = link_to _('Learn more'), help_page_path('user/permissions', anchor: 'setting-new-users-to-external'),
-          target: '_blank'
+        = link_to _('Learn more'), help_page_path('user/permissions', anchor: 'setting-new-users-to-external'), target: '_blank', rel: 'noopener noreferrer'
     - unless Gitlab.com?
       .form-group
         = f.label :deactivate_dormant_users, _('Dormant users'), class: 'label-bold'
@@ -63,7 +62,7 @@
             = _('Deactivate dormant users after 90 days of inactivity')
             .help-block
               = _('Users can reactivate their account by signing in.')
-              = link_to _('Learn more'), help_page_path('user/admin_area/moderate_users', anchor: 'automatically-deactivate-dormant-users'), target: '_blank'
+              = link_to _('Learn more'), help_page_path('user/admin_area/moderate_users', anchor: 'automatically-deactivate-dormant-users'), target: '_blank', rel: 'noopener noreferrer'
     .form-group
       = f.label :personal_access_token_prefix, _('Personal Access Token prefix'), class: 'label-light'
       = f.text_field :personal_access_token_prefix, placeholder: _('Maximum 20 characters'), class: 'form-control gl-form-input'

app/views/admin/application_settings/_ci_cd.html.haml

@@ -9,13 +9,13 @@
           = s_('CICD|Default to Auto DevOps pipeline for all projects')
         .form-text.text-muted
           = s_('CICD|The Auto DevOps pipeline runs by default in all projects with no CI/CD configuration file.')
-          = link_to _('What is Auto DevOps?'), help_page_path('topics/autodevops/index.md'), target: '_blank'
+          = link_to _('What is Auto DevOps?'), help_page_path('topics/autodevops/index.md'), target: '_blank', rel: 'noopener noreferrer'
     .form-group
       = f.label :auto_devops_domain, s_('AdminSettings|Auto DevOps domain'), class: 'label-bold'
       = f.text_field :auto_devops_domain, class: 'form-control gl-form-input', placeholder: 'example.com'
       .form-text.text-muted
         = s_("AdminSettings|The default domain to use for Auto Review Apps and Auto Deploy stages in all projects.")
-        = link_to _('Learn more.'), help_page_path('topics/autodevops/stages.md', anchor: 'auto-review-apps'), target: '_blank'
+        = link_to _('Learn more.'), help_page_path('topics/autodevops/stages.md', anchor: 'auto-review-apps'), target: '_blank', rel: 'noopener noreferrer'
 
     .form-group
       .form-check
@@ -68,7 +68,7 @@
       = f.text_field :default_ci_config_path, class: 'form-control gl-form-input', placeholder: '.gitlab-ci.yml'
       %p.form-text.text-muted
         = _("The default CI/CD configuration file and path for new projects.").html_safe
-        = link_to sprite_icon('question-o'), help_page_path('ci/pipelines/settings', anchor: 'specify-a-custom-cicd-configuration-file'), target: '_blank'
+        = link_to sprite_icon('question-o'), help_page_path('ci/pipelines/settings', anchor: 'specify-a-custom-cicd-configuration-file'), target: '_blank', rel: 'noopener noreferrer'
     .form-group
       .form-check
         = f.check_box :suggest_pipeline_enabled, class: 'form-check-input'

app/views/admin/application_settings/_email.html.haml

@@ -20,7 +20,7 @@
       = f.label :commit_email_hostname, _('Custom hostname (for private commit emails)'), class: 'label-bold'
       = f.text_field :commit_email_hostname, class: 'form-control gl-form-input'
       .form-text.text-muted
-        - commit_email_hostname_docs_link = link_to _('Learn more'), help_page_path('user/admin_area/settings/email.md', anchor: 'custom-hostname-for-private-commit-emails'), target: '_blank'
+        - commit_email_hostname_docs_link = link_to _('Learn more'), help_page_path('user/admin_area/settings/email.md', anchor: 'custom-hostname-for-private-commit-emails'), target: '_blank', rel: 'noopener noreferrer'
         = _("Hostname used in private commit emails. %{learn_more}").html_safe % { learn_more: commit_email_hostname_docs_link }
 
     = render_if_exists 'admin/application_settings/email_additional_text_setting', form: f

app/views/admin/application_settings/_floc.html.haml

@@ -8,7 +8,7 @@
       = expanded ? _('Collapse') : _('Expand')
     %p
       = s_('FloC|Configure whether you want to participate in FloC.').html_safe
-      = link_to sprite_icon('question-o'), 'https://github.com/WICG/floc', target: '_blank', class: 'has-tooltip', title: _('More information')
+      = link_to sprite_icon('question-o'), 'https://github.com/WICG/floc', target: '_blank', rel: 'noopener noreferrer', class: 'has-tooltip', title: _('More information')
 
   .settings-content
     = form_for @application_setting, url: general_admin_application_settings_path(anchor: 'js-floc-settings'), html: { class: 'fieldset-form', id: 'floc-settings' } do |f|

app/views/admin/application_settings/_localization.html.haml

@@ -7,7 +7,7 @@
       = f.select :first_day_of_week, first_day_of_week_choices, {}, class: 'form-control'
       .form-text.text-muted
         = _('Default first day of the week in calendars and date pickers.')
-        = link_to _('Learn more.'), help_page_path('user/admin_area/settings/index.md', anchor: 'default-first-day-of-the-week'), target: '_blank'
+        = link_to _('Learn more.'), help_page_path('user/admin_area/settings/index.md', anchor: 'default-first-day-of-the-week'), target: '_blank', rel: 'noopener noreferrer'
 
     .form-group
       = f.label :time_tracking, _('Time tracking'), class: 'label-bold'
@@ -17,7 +17,7 @@
           = _('Limit display of time tracking units to hours.')
         .form-text.text-muted
           = _('Display time tracking in issues in total hours only.')
-          = link_to _('What is time tracking?'), help_page_path('user/project/time_tracking.md'), target: '_blank'
+          = link_to _('What is time tracking?'), help_page_path('user/project/time_tracking.md'), target: '_blank', rel: 'noopener noreferrer'
 
   = f.submit _('Save changes'), class: "gl-button btn btn-confirm"
 

app/views/admin/application_settings/_prometheus.html.haml

@@ -9,7 +9,7 @@
           = _("Enable health and performance metrics endpoint")
         .form-text.text-muted
           = _('Enable a Prometheus endpoint that exposes health and performance statistics. The Health Check menu item appears in the Monitoring section of the Admin Area. Restart required.')
-          = link_to _('Learn More.'), help_page_path('administration/monitoring/prometheus/gitlab_metrics.md'), target: '_blank'
+          = link_to _('Learn More.'), help_page_path('administration/monitoring/prometheus/gitlab_metrics.md'), target: '_blank', rel: 'noopener noreferrer'
         - unless Gitlab::Metrics.metrics_folder_present?
           .form-text.text-muted
             %strong.cred= _("WARNING:")

app/views/admin/application_settings/_sourcegraph.html.haml

@@ -12,7 +12,7 @@
       - link_end = "#{sprite_icon('external-link', size: 12, css_class: 'ml-1 vertical-align-center')}</a>".html_safe
       = s_('SourcegraphAdmin|Enable code intelligence powered by %{link_start}Sourcegraph%{link_end} on your GitLab instance\'s code views and merge requests.').html_safe % { link_start: link_start, link_end: link_end }
       %span
-        = link_to s_('SourcegraphAdmin|More information'), help_page_path('integration/sourcegraph.md'), target: '_blank'
+        = link_to s_('SourcegraphAdmin|More information'), help_page_path('integration/sourcegraph.md'), target: '_blank', rel: 'noopener noreferrer'
 
 
   .settings-content

app/views/admin/application_settings/_spam.html.haml

@@ -27,7 +27,7 @@
       = f.text_field :recaptcha_site_key, class: 'form-control gl-form-input'
       .form-text.text-muted
         = _("Generate site and private keys at")
-        %a{ href: 'http://www.google.com/recaptcha', target: 'blank' } http://www.google.com/recaptcha
+        %a{ href: 'http://www.google.com/recaptcha', target: 'blank', rel: 'noopener noreferrer' } http://www.google.com/recaptcha
 
     .form-group
       = f.label :recaptcha_private_key, _('reCAPTCHA private key'), class: 'label-bold'
@@ -65,7 +65,7 @@
       = f.text_field :akismet_api_key, class: 'form-control gl-form-input'
       .form-text.text-muted
         Generate API key at
-        %a{ href: 'http://www.akismet.com', target: 'blank' } http://www.akismet.com
+        %a{ href: 'http://www.akismet.com', target: 'blank', rel: 'noopener noreferrer' } http://www.akismet.com
 
     %h5
       = _('IP address restrictions')

app/views/admin/cohorts/_cohorts_table.html.haml

@@ -2,7 +2,7 @@
 .bs-callout.clearfix
   %p
     = s_("Cohorts|User cohorts are shown for the last %{months_included} months. Only users with activity are counted in the 'New users' column; inactive users are counted separately.") % { months_included: @cohorts[:months_included] }
-    = link_to sprite_icon('question-o'), help_page_path('user/admin_area/user_cohorts', anchor: 'cohorts'), title: 'About this feature', target: '_blank'
+    = link_to sprite_icon('question-o'), help_page_path('user/admin_area/user_cohorts', anchor: 'cohorts'), title: 'About this feature', target: '_blank', rel: 'noopener noreferrer'
 
 .table-holder.d-xl-table
   %table.table

app/views/ci/runner/_how_to_setup_runner.html.haml

-- link = link_to _("Install GitLab Runner and ensure it's running."), 'https://docs.gitlab.com/runner/install/', target: '_blank'
+- link = link_to _("Install GitLab Runner and ensure it's running."), 'https://docs.gitlab.com/runner/install/', target: '_blank', rel: 'noopener noreferrer'
 .gl-mb-3
   %h5= _("Set up a %{type} Runner for a project") % { type: type }
 %ol

app/views/clusters/clusters/_advanced_settings.html.haml

@@ -23,7 +23,7 @@
             placeholder: _('Select project'), idAttribute: 'id', data: { order_by: 'last_activity_at', idattribute: 'id', simple_filter: true, allow_clear: true, include_groups: false, include_projects_in_subgroups: true, group_id: group_id, user_id: user_id }, value: @cluster.management_project_id)
         .text-muted
           = html_escape(s_('ClusterIntegration|A cluster management project can be used to run deployment jobs with Kubernetes %{code_open}cluster-admin%{code_close} privileges.')) % { code_open: '<code>'.html_safe, code_close: '</code>'.html_safe }
-          = link_to _('More information'), help_page_path('user/clusters/management_project.md'), target: '_blank'
+          = link_to _('More information'), help_page_path('user/clusters/management_project.md'), target: '_blank', rel: 'noopener noreferrer'
       = field.submit _('Save changes'), class: 'btn gl-button btn-confirm'
 
   .sub-section.form-group

app/views/clusters/clusters/_integrations.html.haml

 .settings.expanded.border-0.m-0
   %p
     = s_('ClusterIntegration|Integrations allow you to use applications installed in your cluster as part of your GitLab workflow.')
-    = link_to _('Learn more'), help_page_path('user/clusters/integrations.md'), target: '_blank'
+    = link_to _('Learn more'), help_page_path('user/clusters/integrations.md'), target: '_blank', rel: 'noopener noreferrer'
   .settings-content#integrations-settings-section
     - if can?(current_user, :admin_cluster, @cluster)
       .sub-section.form-group

app/views/clusters/clusters/_namespace.html.haml

 - managed_namespace_help_text = s_('ClusterIntegration|Set a prefix for your namespaces. If not set, defaults to your project path. If modified, existing environments will use their current namespaces until the cluster cache is cleared.')
 - non_managed_namespace_help_text = s_('ClusterIntegration|The namespace associated with your project. This will be used for deploy boards, logs, and Web terminals.')
-- managed_namespace_help_link = link_to _('More information'), help_page_path('user/project/clusters/gitlab_managed_clusters.md'), target: '_blank'
+- managed_namespace_help_link = link_to _('More information'), help_page_path('user/project/clusters/gitlab_managed_clusters.md'), target: '_blank', rel: 'noopener noreferrer'
 
 .js-namespace-prefixed
   = platform_field.text_field :namespace,

app/views/clusters/clusters/_provider_details_form.html.haml

@@ -43,13 +43,13 @@
         label_class: 'label-bold' }
       .form-text.text-muted
         = s_('ClusterIntegration|Allow GitLab to manage namespaces and service accounts for this cluster.')
-        = link_to _('More information'), help_page_path('user/project/clusters/gitlab_managed_clusters.md'), target: '_blank'
+        = link_to _('More information'), help_page_path('user/project/clusters/gitlab_managed_clusters.md'), target: '_blank', rel: 'noopener noreferrer'
 
     .form-group
       = field.check_box :namespace_per_environment, { label: s_('ClusterIntegration|Namespace per environment'), label_class: 'label-bold' }
       .form-text.text-muted
         = s_('ClusterIntegration|Deploy each environment to its own namespace. Otherwise, environments within a project share a project-wide namespace. Note that anyone who can trigger a deployment of a namespace can read its secrets. If modified, existing environments will use their current namespaces until the cluster cache is cleared.')
-        = link_to _('More information'), help_page_path('user/project/clusters/deploy_to_cluster.md', anchor: 'custom-namespace'), target: '_blank'
+        = link_to _('More information'), help_page_path('user/project/clusters/deploy_to_cluster.md', anchor: 'custom-namespace'), target: '_blank', rel: 'noopener noreferrer'
 
     - if cluster.allow_user_defined_namespace?
       = render('clusters/clusters/namespace', platform_field: platform_field, field: field)

app/views/clusters/clusters/gcp/_form.html.haml

@@ -67,20 +67,20 @@
         label_class: 'label-bold' }
       .form-text.text-muted
         = s_('ClusterIntegration|Uses the Cloud Run, Istio, and HTTP Load Balancing addons for this cluster.')
-        = link_to _('More information'), help_page_path('user/project/clusters/add_gke_clusters.md', anchor: 'cloud-run-for-anthos'), target: '_blank'
+        = link_to _('More information'), help_page_path('user/project/clusters/add_gke_clusters.md', anchor: 'cloud-run-for-anthos'), target: '_blank', rel: 'noopener noreferrer'
 
   .form-group
     = field.check_box :managed, { label: s_('ClusterIntegration|GitLab-managed cluster'),
       label_class: 'label-bold' }
     .form-text.text-muted
       = s_('ClusterIntegration|Allow GitLab to manage namespaces and service accounts for this cluster.')
-      = link_to _('More information'), help_page_path('user/project/clusters/gitlab_managed_clusters.md'), target: '_blank'
+      = link_to _('More information'), help_page_path('user/project/clusters/gitlab_managed_clusters.md'), target: '_blank', rel: 'noopener noreferrer'
 
   .form-group
     = field.check_box :namespace_per_environment, { label: s_('ClusterIntegration|Namespace per environment'), label_class: 'label-bold' }
     .form-text.text-muted
       = s_('ClusterIntegration|Deploy each environment to its own namespace. Otherwise, environments within a project share a project-wide namespace. Note that anyone who can trigger a deployment of a namespace can read its secrets. If modified, existing environments will use their current namespaces until the cluster cache is cleared.')
-      = link_to _('More information'), help_page_path('user/project/clusters/deploy_to_cluster.md', anchor: 'custom-namespace'), target: '_blank'
+      = link_to _('More information'), help_page_path('user/project/clusters/deploy_to_cluster.md', anchor: 'custom-namespace'), target: '_blank', rel: 'noopener noreferrer'
 
   .form-group.js-gke-cluster-creation-submit-container
     = field.submit s_('ClusterIntegration|Create Kubernetes cluster'),

app/views/clusters/clusters/show.html.haml

@@ -36,7 +36,7 @@
       = sprite_icon('close', css_class: 'gl-icon')
     .gl-alert-body
       = s_('ClusterApplicationsRemoved|One-click application management was removed in GitLab 14.0. Your applications are still installed in your cluster, and integrations continue working.')
-      = link_to _('More information.'), help_page_path("user/clusters/applications"), target: '_blank'
+      = link_to _('More information.'), help_page_path("user/clusters/applications"), target: '_blank', rel: 'noopener noreferrer'
 
   - if cluster_created?(@cluster)
     .js-toggle-container

app/views/clusters/clusters/user/_form.html.haml

 - more_info_link = link_to _('More information'), help_page_path('user/project/clusters/add_remove_clusters.md',
-  anchor: 'add-existing-cluster'), target: '_blank'
+  anchor: 'add-existing-cluster'), target: '_blank', rel: 'noopener noreferrer'
 - rbac_help_link = link_to _('More information'), help_page_path('user/project/clusters/add_remove_clusters.md',
-  anchor: 'access-controls'), target: '_blank'
+  anchor: 'access-controls'), target: '_blank', rel: 'noopener noreferrer'
 
 - api_url_help_text = s_('ClusterIntegration|The URL used to access the Kubernetes API.')
 - ca_cert_help_text = s_('ClusterIntegration|The Kubernetes certificate used to authenticate to the cluster.')
@@ -47,13 +47,13 @@
       label_class: 'label-bold' }
     .form-text.text-muted
       = s_('ClusterIntegration|Allow GitLab to manage namespaces and service accounts for this cluster.')
-      = link_to _('More information'), help_page_path('user/project/clusters/gitlab_managed_clusters.md'), target: '_blank'
+      = link_to _('More information'), help_page_path('user/project/clusters/gitlab_managed_clusters.md'), target: '_blank', rel: 'noopener noreferrer'
 
   .form-group
     = field.check_box :namespace_per_environment, { label: s_('ClusterIntegration|Namespace per environment'), label_class: 'label-bold' }
     .form-text.text-muted
       = s_('ClusterIntegration|Deploy each environment to its own namespace. Otherwise, environments within a project share a project-wide namespace. Note that anyone who can trigger a deployment of a namespace can read its secrets. If modified, existing environments will use their current namespaces until the cluster cache is cleared.')
-      = link_to _('More information'), help_page_path('user/project/clusters/deploy_to_cluster.md', anchor: 'custom-namespace'), target: '_blank'
+      = link_to _('More information'), help_page_path('user/project/clusters/deploy_to_cluster.md', anchor: 'custom-namespace'), target: '_blank', rel: 'noopener noreferrer'
 
   = field.fields_for :platform_kubernetes, @user_cluster.platform_kubernetes do |platform_kubernetes_field|
     - if @user_cluster.allow_user_defined_namespace?

app/views/groups/_new_group_fields.html.haml

@@ -7,7 +7,7 @@
       = _('Visibility level')
     %p
       = _('Who will be able to see this group?')
-      = link_to _('View the documentation'), help_page_path("public_access/public_access"), target: '_blank'
+      = link_to _('View the documentation'), help_page_path("public_access/public_access"), target: '_blank', rel: 'noopener noreferrer'
     = render 'shared/visibility_level', f: f, visibility_level: default_group_visibility, can_change_visibility_level: true, form_model: @group, with_label: false
 
 - if Gitlab.config.mattermost.enabled

app/views/groups/settings/ci_cd/_auto_devops_form.html.haml

@@ -11,5 +11,6 @@
               = gl_badge_tag badge_for_auto_devops_scope(group), variant: :info
             .form-text.text-muted
               = s_('GroupSettings|The Auto DevOps pipeline runs if no alternative CI configuration file is found.')
-              = link_to _('Learn more.'), help_page_path('topics/autodevops/index.md'), target: '_blank'
+              = link_to _('Learn more.'), help_page_path('topics/autodevops/index.md'), target: '_blank', rel: 'noopener noreferrer'
+
       = f.submit _('Save changes'), class: 'btn gl-button btn-confirm gl-mt-5'

app/views/profiles/accounts/show.html.haml

@@ -55,7 +55,7 @@
       %p
         = s_('Profiles|Changing your username can have unintended side effects.')
         = succeed '.' do
-          = link_to s_('Profiles|Learn more'), help_page_path('user/profile/index', anchor: 'change-your-username'), target: '_blank'
+          = link_to s_('Profiles|Learn more'), help_page_path('user/profile/index', anchor: 'change-your-username'), target: '_blank', rel: 'noopener noreferrer'
     .col-lg-8
       - data = { initial_username: current_user.username, root_url: root_url, action_url: update_username_profile_path(format: :json) }
       #update-username{ data: data }

app/views/profiles/preferences/show.html.haml

@@ -33,7 +33,7 @@
       %p
         = s_('Preferences|This setting allows you to customize the appearance of the syntax.')
         = succeed '.' do
-          = link_to _('Learn more'), help_page_path('user/profile/preferences', anchor: 'syntax-highlighting-theme'), target: '_blank'
+          = link_to _('Learn more'), help_page_path('user/profile/preferences', anchor: 'syntax-highlighting-theme'), target: '_blank', rel: 'noopener noreferrer'
     .col-lg-8.syntax-theme
       - Gitlab::ColorSchemes.each do |scheme|
         = label_tag do
@@ -51,7 +51,7 @@
       %p
         = s_('Preferences|This setting allows you to customize the behavior of the system layout and default views.')
         = succeed '.' do
-          = link_to _('Learn more'), help_page_path('user/profile/preferences', anchor: 'behavior'), target: '_blank'
+          = link_to _('Learn more'), help_page_path('user/profile/preferences', anchor: 'behavior'), target: '_blank', rel: 'noopener noreferrer'
     .col-lg-8
       .form-group
         = f.label :layout, class: 'label-bold' do
@@ -116,7 +116,7 @@
       %p
         = _('Customize language and region related settings.')
         = succeed '.' do
-          = link_to _('Learn more'), help_page_path('user/profile/preferences', anchor: 'localization'), target: '_blank'
+          = link_to _('Learn more'), help_page_path('user/profile/preferences', anchor: 'localization'), target: '_blank', rel: 'noopener noreferrer'
     .col-lg-8
       .form-group
         = f.label :preferred_language, class: 'label-bold' do
@@ -137,7 +137,7 @@
       %p
         = s_('Preferences|Configure how dates and times display for you.')
         = succeed '.' do
-          = link_to _('Learn more'), help_page_path('user/profile/preferences', anchor: 'time-preferences'), target: '_blank'
+          = link_to _('Learn more'), help_page_path('user/profile/preferences', anchor: 'time-preferences'), target: '_blank', rel: 'noopener noreferrer'
     .col-lg-8
       .form-group.form-check
         = f.check_box :time_display_relative, class: 'form-check-input'

app/views/projects/_merge_request_squash_options_settings.html.haml

@@ -5,9 +5,7 @@
     %b= s_('ProjectSettings|Squash commits when merging')
     %p.text-secondary
       = s_('ProjectSettings|Set the default behavior of this option in merge requests. Changes to this are also applied to existing merge requests.')
-      = link_to "What is squashing?",
-        help_page_path('user/project/merge_requests/squash_and_merge.md'),
-        target: '_blank'
+      = link_to "What is squashing?", help_page_path('user/project/merge_requests/squash_and_merge.md'), target: '_blank', rel: 'noopener noreferrer'
 
     .form-check.gl-mb-2
       = settings.radio_button :squash_option, :never, class: "form-check-input"

app/views/projects/default_branch/_show.html.haml

@@ -26,6 +26,6 @@
               %strong= _("Auto-close referenced issues on default branch")
             .form-text.text-muted
               = _("When merge requests and commits in the default branch close, any issues they reference also close.")
-              = link_to sprite_icon('question-o'), help_page_path('user/project/issues/managing_issues.md', anchor: 'closing-issues-automatically'), target: '_blank'
+              = link_to sprite_icon('question-o'), help_page_path('user/project/issues/managing_issues.md', anchor: 'closing-issues-automatically'), target: '_blank', rel: 'noopener noreferrer'
 
       = f.submit _('Save changes'), class: "gl-button btn btn-confirm", data: { qa_selector: 'save_changes_button' }

app/views/projects/issues/_by_email_description.html.haml

 The subject will be used as the title of the new issue, and the message will be the description.
 
-= link_to 'Quick actions', help_page_path('user/project/quick_actions'), target: '_blank'
+= link_to 'Quick actions', help_page_path('user/project/quick_actions'), target: '_blank', rel: 'noopener noreferrer'
 and styling with
-= link_to 'Markdown', help_page_path('user/markdown'), target: '_blank'
+= link_to 'Markdown', help_page_path('user/markdown'), target: '_blank', rel: 'noopener noreferrer'
 are supported.

app/views/projects/settings/ci_cd/_autodevops_form.html.haml

@@ -26,7 +26,7 @@
                       = gl_badge_tag badge_for_auto_devops_scope(@project), { variant: :info }, { class: 'js-instance-default-badge'}
                   .form-text.text-muted
                     = s_('CICD|The Auto DevOps pipeline runs if no alternative CI configuration file is found.')
-                    = link_to _('Learn more.'), help_page_path('topics/autodevops/index.md'), target: '_blank'
+                    = link_to _('Learn more.'), help_page_path('topics/autodevops/index.md'), target: '_blank', rel: 'noopener noreferrer'
               .card-footer.js-extra-settings{ class: auto_devops_enabled || 'hidden' }
                 - if @project.all_clusters.empty?
                   %p.settings-message.text-center
@@ -40,18 +40,18 @@
                   = form.radio_button :deploy_strategy, 'continuous', class: 'form-check-input'
                   = form.label :deploy_strategy_continuous, class: 'form-check-label' do
                     = s_('CICD|Continuous deployment to production')
-                    = link_to sprite_icon('question-o'), help_page_path('topics/autodevops/stages.md', anchor: 'auto-deploy'), target: '_blank'
+                    = link_to sprite_icon('question-o'), help_page_path('topics/autodevops/stages.md', anchor: 'auto-deploy'), target: '_blank', rel: 'noopener noreferrer'
 
                 .form-check
                   = form.radio_button :deploy_strategy, 'timed_incremental', class: 'form-check-input'
                   = form.label :deploy_strategy_timed_incremental, class: 'form-check-label' do
                     = s_('CICD|Continuous deployment to production using timed incremental rollout')
-                    = link_to sprite_icon('question-o'), help_page_path('topics/autodevops/customize.md', anchor: 'timed-incremental-rollout-to-production'), target: '_blank'
+                    = link_to sprite_icon('question-o'), help_page_path('topics/autodevops/customize.md', anchor: 'timed-incremental-rollout-to-production'), target: '_blank', rel: 'noopener noreferrer'
 
                 .form-check
                   = form.radio_button :deploy_strategy, 'manual', class: 'form-check-input'
                   = form.label :deploy_strategy_manual, class: 'form-check-label' do
                     = s_('CICD|Automatic deployment to staging, manual deployment to production')
-                    = link_to sprite_icon('question-o'), help_page_path('topics/autodevops/customize.md', anchor: 'incremental-rollout-to-production'), target: '_blank'
+                    = link_to sprite_icon('question-o'), help_page_path('topics/autodevops/customize.md', anchor: 'incremental-rollout-to-production'), target: '_blank', rel: 'noopener noreferrer'
 
           = f.submit _('Save changes'), class: "btn gl-button btn-confirm gl-mt-5", data: { qa_selector: 'save_changes_button' }

app/views/projects/settings/ci_cd/_form.html.haml

@@ -10,7 +10,7 @@
               %strong= _("Public pipelines")
             .form-text.text-muted
               = _("Allow public access to pipelines and job details, including output logs and artifacts.")
-              = link_to sprite_icon('question-o'), help_page_path('ci/pipelines/settings', anchor: 'change-which-users-can-view-your-pipelines'), target: '_blank'
+              = link_to sprite_icon('question-o'), help_page_path('ci/pipelines/settings', anchor: 'change-which-users-can-view-your-pipelines'), target: '_blank', rel: 'noopener noreferrer'
 
         .form-group
           .form-check
@@ -19,7 +19,7 @@
               %strong= _("Auto-cancel redundant pipelines")
             .form-text.text-muted
               = _("New pipelines cause older pending or running pipelines on the same branch to be cancelled.")
-              = link_to sprite_icon('question-o'), help_page_path('ci/pipelines/settings', anchor: 'auto-cancel-redundant-pipelines'), target: '_blank'
+              = link_to sprite_icon('question-o'), help_page_path('ci/pipelines/settings', anchor: 'auto-cancel-redundant-pipelines'), target: '_blank', rel: 'noopener noreferrer'
 
         .form-group
           .form-check
@@ -29,14 +29,14 @@
                 %strong= _("Skip outdated deployment jobs")
               .form-text.text-muted
                 = _("When a deployment job is successful, skip older deployment jobs that are still pending.")
-                = link_to sprite_icon('question-o'), help_page_path('ci/pipelines/settings', anchor: 'skip-outdated-deployment-jobs'), target: '_blank'
+                = link_to sprite_icon('question-o'), help_page_path('ci/pipelines/settings', anchor: 'skip-outdated-deployment-jobs'), target: '_blank', rel: 'noopener noreferrer'
 
         .form-group
           = f.label :ci_config_path, _('CI/CD configuration file'), class: 'label-bold'
           = f.text_field :ci_config_path, class: 'form-control', placeholder: '.gitlab-ci.yml'
           %p.form-text.text-muted
             = html_escape(_("The name of the CI/CD configuration file. A path relative to the root directory is optional (for example %{code_open}my/path/.myfile.yml%{code_close}).")) % { code_open: '<code>'.html_safe, code_close: '</code>'.html_safe }
-            = link_to sprite_icon('question-o'), help_page_path('ci/pipelines/settings', anchor: 'specify-a-custom-cicd-configuration-file'), target: '_blank'
+            = link_to sprite_icon('question-o'), help_page_path('ci/pipelines/settings', anchor: 'specify-a-custom-cicd-configuration-file'), target: '_blank', rel: 'noopener noreferrer'
 
         %hr
         .form-group
@@ -44,7 +44,7 @@
             = _("Git strategy")
           %p
             = _("Choose which Git strategy to use when fetching the project.")
-            = link_to sprite_icon('question-o'), help_page_path('ci/pipelines/settings', anchor: 'choose-the-default-git-strategy'), target: '_blank'
+            = link_to sprite_icon('question-o'), help_page_path('ci/pipelines/settings', anchor: 'choose-the-default-git-strategy'), target: '_blank', rel: 'noopener noreferrer'
           .form-check
             = f.radio_button :build_allow_git_fetch, 'false', { class: 'form-check-input' }
             = f.label :build_allow_git_fetch_false, class: 'form-check-label' do
@@ -66,7 +66,7 @@
             = form.number_field :default_git_depth, { class: 'form-control gl-form-input', min: 0, max: 1000 }
             %p.form-text.text-muted
               = html_escape(_('The number of changes to fetch from GitLab when cloning a repository. Lower values can speed up pipeline execution. Set to %{code_open}0%{code_close} or blank to fetch all branches and tags for each job')) % { code_open: '<code>'.html_safe, code_close: '</code>'.html_safe }
-              = link_to sprite_icon('question-o'), help_page_path('ci/pipelines/settings', anchor: 'limit-the-number-of-changes-fetched-during-clone'), target: '_blank'
+              = link_to sprite_icon('question-o'), help_page_path('ci/pipelines/settings', anchor: 'limit-the-number-of-changes-fetched-during-clone'), target: '_blank', rel: 'noopener noreferrer'
 
         %hr
         .form-group
@@ -74,7 +74,7 @@
           = f.text_field :build_timeout_human_readable, class: 'form-control gl-form-input'
           %p.form-text.text-muted
             = html_escape(_('Jobs fail if they run longer than the timeout time. Input value is in seconds by default. Human readable input is also accepted, for example %{code_open}1 hour%{code_close}.')) % { code_open: '<code>'.html_safe, code_close: '</code>'.html_safe }
-            = link_to sprite_icon('question-o'), help_page_path('ci/pipelines/settings', anchor: 'set-a-limit-for-how-long-jobs-can-run'), target: '_blank'
+            = link_to sprite_icon('question-o'), help_page_path('ci/pipelines/settings', anchor: 'set-a-limit-for-how-long-jobs-can-run'), target: '_blank', rel: 'noopener noreferrer'
 
         - if can?(current_user, :update_max_artifacts_size, @project)
           .form-group
@@ -82,7 +82,7 @@
             = f.number_field :max_artifacts_size, class: 'form-control gl-form-input'
             %p.form-text.text-muted
               = _("The maximum file size in megabytes for individual job artifacts.")
-              = link_to sprite_icon('question-o'), help_page_path('user/admin_area/settings/continuous_integration', anchor: 'maximum-artifacts-size'), target: '_blank'
+              = link_to sprite_icon('question-o'), help_page_path('user/admin_area/settings/continuous_integration', anchor: 'maximum-artifacts-size'), target: '_blank', rel: 'noopener noreferrer'
 
         .form-group
           = f.label :build_coverage_regex, _("Test coverage parsing"), class: 'label-bold'
@@ -94,7 +94,7 @@
               .input-group-text /
           %p.form-text.text-muted
             = html_escape(_('The regular expression used to find test coverage output in the job log. For example, use %{regex} for Simplecov (Ruby). Leave blank to disable.')) % { regex: '<code>\(\d+.\d+%\)</code>'.html_safe }
-            = link_to sprite_icon('question-o'), help_page_path('ci/pipelines/settings', anchor: 'add-test-coverage-results-to-a-merge-request'), target: '_blank'
+            = link_to sprite_icon('question-o'), help_page_path('ci/pipelines/settings', anchor: 'add-test-coverage-results-to-a-merge-request'), target: '_blank', rel: 'noopener noreferrer'
 
         = f.submit _('Save changes'), class: "btn gl-button btn-confirm", data: { qa_selector: 'save_general_pipelines_changes_button' }
 

app/views/shared/_old_visibility_level.html.haml

 .form-group.row
   .col-sm-2.col-form-label
     = _('Visibility level')
-    = link_to sprite_icon('question-o'), help_page_path('public_access/public_access'), target: '_blank'
+    = link_to sprite_icon('question-o'), help_page_path('public_access/public_access'), target: '_blank', rel: 'noopener noreferrer'
   .col-sm-10
     = render 'shared/visibility_level', f: f, visibility_level: visibility_level, can_change_visibility_level: can_change_visibility_level, form_model: form_model, with_label: with_label

app/views/shared/access_tokens/_form.html.haml

@@ -45,7 +45,7 @@
       = s_('Tokens|Select scopes')
     %p.text-secondary#select_scope_help_text
       = s_('Tokens|Scopes set the permission levels granted to the token.')
-      = link_to "Learn more.", help_path, target: '_blank'
+      = link_to _("Learn more."), help_path, target: '_blank', rel: 'noopener noreferrer'
     = render 'shared/tokens/scopes_form', prefix: prefix, token: token, scopes: scopes
 
   - if prefix == :personal_access_token && Feature.enabled?(:personal_access_tokens_scoped_to_projects, current_user)

app/views/shared/access_tokens/_table.html.haml

@@ -28,7 +28,7 @@
           %th= s_('AccessTokens|Created')
           %th
             = _('Last Used')
-            = link_to sprite_icon('question-o'), help_page_path('user/profile/personal_access_tokens.md', anchor: 'view-the-last-time-a-token-was-used'), target: '_blank'
+            = link_to sprite_icon('question-o'), help_page_path('user/profile/personal_access_tokens.md', anchor: 'view-the-last-time-a-token-was-used'), target: '_blank', rel: 'noopener noreferrer'
           %th= _('Expires')
           - if project
             %th= _('Role')

app/views/shared/issuable/form/_merge_params.html.haml

@@ -25,7 +25,7 @@
           = check_box_tag 'merge_request[squash]', '1', issuable_squash_option?(issuable, project), class: 'form-check-input'
         = label_tag 'merge_request[squash]', class: 'form-check-label' do
           Squash commits when merge request is accepted.
-          = link_to sprite_icon('question-o'), help_page_path('user/project/merge_requests/squash_and_merge'), target: '_blank'
+          = link_to sprite_icon('question-o'), help_page_path('user/project/merge_requests/squash_and_merge'), target: '_blank', rel: 'noopener noreferrer'
         - if project.squash_always?
           .gl-text-gray-400
             = _('Required in this project.')

app/views/shared/notes/_hints.html.haml

@@ -2,10 +2,10 @@
 - supports_file_upload = local_assigns.fetch(:supports_file_upload, true)
 .comment-toolbar.clearfix
   .toolbar-text
-    = link_to _('Markdown'), help_page_path('user/markdown'), target: '_blank'
+    = link_to _('Markdown'), help_page_path('user/markdown'), target: '_blank', rel: 'noopener noreferrer'
     - if supports_quick_actions
       and
-      = link_to _('quick actions'), help_page_path('user/project/quick_actions'), target: '_blank'
+      = link_to _('quick actions'), help_page_path('user/project/quick_actions'), target: '_blank', rel: 'noopener noreferrer'
       are
     - else
       is

app/views/shared/runners/_shared_runners_description.html.haml

 -# "MaxBuilds" is a runner configuration keyword so it must not be translated.
-- link = link_to 'MaxBuilds', 'https://docs.gitlab.com/runner/configuration/advanced-configuration.html#the-runnersmachine-section', target: '_blank'
+- link = link_to 'MaxBuilds', 'https://docs.gitlab.com/runner/configuration/advanced-configuration.html#the-runnersmachine-section', target: '_blank', rel: 'noopener noreferrer'
 
 %h4
   = _('Shared runners')

ee/app/views/admin/application_settings/_shared_runners_minutes_setting.html.haml

@@ -3,4 +3,4 @@
   = form.number_field :shared_runners_minutes, class: 'form-control gl-form-input'
   .form-text.text-muted
     = _('The maximum number of CI/CD minutes on shared runners that a group can use each month. 0 for unlimited.')
-    = link_to _('What are CI/CD minutes?'), help_page_path('ci/pipelines/cicd_minutes'), target: '_blank'
+    = link_to _('What are CI/CD minutes?'), help_page_path('ci/pipelines/cicd_minutes'), target: '_blank', rel: 'noopener noreferrer'

ee/app/views/namespaces/_shared_runner_status.html.haml

@@ -7,4 +7,4 @@
     %span.light= _('Quota of CI/CD minutes:')
     %strong
       = ci_minutes_report(minutes_quota_presenter.monthly_minutes_report)
-      = link_to sprite_icon('question-o'), help_page_path('ci/pipelines/cicd_minutes'), target: '_blank'
+      = link_to sprite_icon('question-o'), help_page_path('ci/pipelines/cicd_minutes'), target: '_blank', rel: 'noopener noreferrer'

ee/app/views/namespaces/_shared_runners_minutes_setting.html.haml

@@ -11,4 +11,4 @@
       The maximum number of CI/CD minutes on shared runners that a group can use each month.
       Set 0 for unlimited.
       Set empty to inherit the global setting of #{Gitlab::CurrentSettings.shared_runners_minutes}.
-      = link_to sprite_icon('question-o'), help_page_path('ci/pipelines/cicd_minutes'), target: '_blank'
+      = link_to sprite_icon('question-o'), help_page_path('ci/pipelines/cicd_minutes'), target: '_blank', rel: 'noopener noreferrer'

ee/app/views/projects/blob/_owners.html.haml

@@ -5,6 +5,6 @@
   = sprite_icon('users', size: 18, css_class: 'icon')
   %strong
     = _("Code owners")
-  = link_to sprite_icon('question-o'), help_page_path('user/project/code_owners'), title: 'About this feature', target: '_blank'
+  = link_to sprite_icon('question-o'), help_page_path('user/project/code_owners'), title: 'About this feature', target: '_blank', rel: 'noopener noreferrer'
   :
   = users_sentence(owners, link_class: 'file-owner-link qa-link-file-owner')

ee/app/views/shared/_ultimate_trial_callout_content.html.haml

@@ -13,7 +13,7 @@
           %p
             %span= _('Try all GitLab has to offer for 30 days.')
             %span.d-none.d-sm-inline= _('No credit card required.')
-          = link_to _('Start your free trial'), new_trial_registration_path(glm_source: 'gitlab.com', glm_content: 'gold-callout'), class: "btn btn-confirm gl-button mt-2 mt-sm-0 #{button_css_class}", target: '_blank'
+          = link_to _('Start your free trial'), new_trial_registration_path(glm_source: 'gitlab.com', glm_content: 'gold-callout'), class: "btn btn-confirm gl-button mt-2 mt-sm-0 #{button_css_class}", target: '_blank', rel: 'noopener noreferrer'
         - if is_dismissable
           %button.btn.gl-banner-close.btn-default.btn-sm.gl-button.btn-default-tertiary.btn-icon.close.js-close{ class: 'gl-opacity-10!', type: 'button', 'aria-label' => _('Dismiss trial promotion') }
             = sprite_icon('close', css_class: 'dismiss-icon gl-text-gray-700!')

ee/app/views/shared/promotions/_promote_advanced_search.html.haml

@@ -13,6 +13,6 @@
             = s_('Promotions|Improve search with Advanced Search and GitLab Enterprise Edition.')
         %p
           = s_('Promotions|The Advanced Search in GitLab is a powerful search service that saves you time. Instead of creating duplicate code and wasting time, you can now search for code within other teams that can help your own project.')
-          = link_to _('Read more'), help_page_path('user/search/advanced_search.md'), target: '_blank'
+          = link_to _('Read more'), help_page_path('user/search/advanced_search.md'), target: '_blank', rel: 'noopener noreferrer'
 
         = render 'shared/promotions/promotion_link_project', location: :advanced_search

ee/app/views/shared/promotions/_promote_audit_events.html.haml

@@ -8,6 +8,6 @@
         = s_('Promotions|Keep track of events in your project')
     %p
       = s_('Automatic event tracking provides a traceable history for audits.')
-      = link_to _('Learn more.'), help_page_path('administration/audit_events.md', anchor: 'project-events'), target: '_blank'
+      = link_to _('Learn more.'), help_page_path('administration/audit_events.md', anchor: 'project-events'), target: '_blank', rel: 'noopener noreferrer'
 
     = render 'shared/promotions/promotion_link_project', location: :audit_events

ee/app/views/shared/promotions/_promote_burndown_charts.html.haml

@@ -15,6 +15,6 @@
             = s_('Promotions|Improve milestones with Burndown Charts.')
         %p
           = s_('Promotions|Burndown Charts are visual representations of the progress of completing a milestone. At a glance, you see the current state for the completion a given milestone. Without them, you would have to organize the data from the milestone and plot it yourself to have the same sense of progress.')
-          = link_to _('Read more'), help_page_path('user/project/milestones/burndown_and_burnup_charts.md'), target: '_blank'
+          = link_to _('Read more'), help_page_path('user/project/milestones/burndown_and_burnup_charts.md'), target: '_blank', rel: 'noopener noreferrer'
 
         = render 'shared/promotions/promotion_link_project', location: :burndown_charts

ee/app/views/shared/promotions/_promote_epics.html.haml

@@ -19,7 +19,7 @@
         %div
           %p
             = s_('Promotions|Epics let you manage your portfolio of projects more efficiently and with less effort by tracking groups of issues that share a theme, across projects and milestones.')
-            = link_to _('Read more'), 'https://docs.gitlab.com/ee/user/group/epics/', class: 'btn-link', target: '_blank'
+            = link_to _('Read more'), 'https://docs.gitlab.com/ee/user/group/epics/', class: 'btn-link', target: '_blank', rel: 'noopener noreferrer'
           .gl-flex-wrap
             = render 'shared/promotions/promotion_link_project', short_form: true, location: :epics
             = link_to s_("Promotions|Don't show me this again"), '#', class: 'gl-button btn js-close js-close-callout gl-mt-2'

ee/app/views/shared/promotions/_promote_group_webhooks.html.haml

@@ -9,6 +9,6 @@
         = s_('Promotions|Add Group Webhooks and GitLab Enterprise Edition.')
     %p
       = s_('Promotions|Webhooks allow you to trigger a URL if, for example, new code is pushed or a new issue is created. You can configure webhooks to listen for specific events like pushes, issues or merge requests. Group webhooks will apply to all projects in a group, allowing you to standardize webhook functionality across your entire group.')
-      = link_to _('Read more'), help_page_path('user/project/integrations/webhooks.md'), target: '_blank'
+      = link_to _('Read more'), help_page_path('user/project/integrations/webhooks.md'), target: '_blank', rel: 'noopener noreferrer'
     .gl-mt-5
       = render 'shared/promotions/promotion_link_project', location: :group_webhooks

ee/app/views/shared/promotions/_promote_mr_features.html.haml

@@ -12,7 +12,7 @@
         %ul
           - unless @project.feature_available?(:merge_request_approvers)
             %li
-              = link_to s_('Promotions|Merge request approvals'), help_page_path('user/project/merge_requests/approvals/index.md'), target: '_blank'
+              = link_to s_('Promotions|Merge request approvals'), help_page_path('user/project/merge_requests/approvals/index.md'), target: '_blank', rel: 'noopener noreferrer'
               %p
                 = s_('Promotions|Set the number of necessary approvals and define a list of approvers needed for every merge request in a project.')
 

ee/app/views/shared/promotions/_promote_repository_features.html.haml

@@ -14,17 +14,17 @@
         %ul
           - unless @project.feature_available?(:push_rules)
             %li
-              = link_to s_('Promotions|Push Rules'), help_page_path('push_rules/push_rules.md'), target: '_blank'
+              = link_to s_('Promotions|Push Rules'), help_page_path('push_rules/push_rules.md'), target: '_blank', rel: 'noopener noreferrer'
               %p
                 = s_('Promotions|Push Rules are defined per project so you can have different rules applied to different projects depends on your needs.')
           - unless @project.feature_available?(:repository_mirrors)
             %li
-              = link_to s_('Promotions|Repository Mirroring'), help_page_path('user/project/repository/repository_mirroring.md'), target: '_blank'
+              = link_to s_('Promotions|Repository Mirroring'), help_page_path('user/project/repository/repository_mirroring.md'), target: '_blank', rel: 'noopener noreferrer'
               %p
                 = s_('Promotions|Repository Mirroring is a way to mirror repositories from external sources. It can be used to mirror all branches, tags, and commits that you have in your repository.')
           - unless @project.feature_available?(:protected_refs_for_users)
             %li
-              = link_to s_('Promotions|Better Protected Branches'), help_page_path('user/project/protected_branches.md'), target: '_blank'
+              = link_to s_('Promotions|Better Protected Branches'), help_page_path('user/project/protected_branches.md'), target: '_blank', rel: 'noopener noreferrer'
               %p
                 = s_('Promotions|You can restrict access to protected branches by choosing a role (Maintainers, Developers) as well as certain users.')