GeezerVison

For whatwg/html#4330.

For whatwg/html#4330.

…ener support, a=testonly

Automatic update from web-platform-tests
HTML: target=_blank implies noopener; opener support (#15188)

For whatwg/html#4330.
--

wpt-commits: e81ca209b45fbe73c1bb7a20e1c7af51ef46258b
wpt-pr: 15188


--HG--
rename : testing/web-platform/tests/html/semantics/links/links-created-by-a-and-area-elements/support/target_blank_iplicit_noopener.html => testing/web-platform/tests/html/semantics/links/links-created-by-a-and-area-elements/support/target_blank_implicit_noopener.html

…ener support, a=testonly

Automatic update from web-platform-tests
HTML: target=_blank implies noopener; opener support (#15188)

For whatwg/html#4330.
--

wpt-commits: e81ca209b45fbe73c1bb7a20e1c7af51ef46258b
wpt-pr: 15188

…ener support, a=testonly

Automatic update from web-platform-tests
HTML: target=_blank implies noopener; opener support (#15188)

For whatwg/html#4330.
--

wpt-commits: e81ca209b45fbe73c1bb7a20e1c7af51ef46258b
wpt-pr: 15188


--HG--
rename : testing/web-platform/tests/html/semantics/links/links-created-by-a-and-area-elements/support/target_blank_iplicit_noopener.html => testing/web-platform/tests/html/semantics/links/links-created-by-a-and-area-elements/support/target_blank_implicit_noopener.html

…ener support, a=testonly

Automatic update from web-platform-tests
HTML: target=_blank implies noopener; opener support (#15188)

For whatwg/html#4330.
--

wpt-commits: e81ca209b45fbe73c1bb7a20e1c7af51ef46258b
wpt-pr: 15188

…ener support, a=testonly

Automatic update from web-platform-tests
HTML: target=_blank implies noopener; opener support (#15188)

For whatwg/html#4330.
--

wpt-commits: e81ca209b45fbe73c1bb7a20e1c7af51ef46258b
wpt-pr: 15188

UltraBlame original commit: de035411df5175e229feddb7f1cf2f17eeafb872

…ener support, a=testonly

Automatic update from web-platform-tests
HTML: target=_blank implies noopener; opener support (#15188)

For whatwg/html#4330.
--

wpt-commits: e81ca209b45fbe73c1bb7a20e1c7af51ef46258b
wpt-pr: 15188

UltraBlame original commit: de035411df5175e229feddb7f1cf2f17eeafb872

…ener support, a=testonly

Automatic update from web-platform-tests
HTML: target=_blank implies noopener; opener support (#15188)

For whatwg/html#4330.
--

wpt-commits: e81ca209b45fbe73c1bb7a20e1c7af51ef46258b
wpt-pr: 15188

UltraBlame original commit: eca5d888e47f18532896f5671d22f463fab67bf5

…ener support, a=testonly

Automatic update from web-platform-tests
HTML: target=_blank implies noopener; opener support (#15188)

For whatwg/html#4330.
--

wpt-commits: e81ca209b45fbe73c1bb7a20e1c7af51ef46258b
wpt-pr: 15188

UltraBlame original commit: de035411df5175e229feddb7f1cf2f17eeafb872

…ener support, a=testonly

Automatic update from web-platform-tests
HTML: target=_blank implies noopener; opener support (#15188)

For whatwg/html#4330.
--

wpt-commits: e81ca209b45fbe73c1bb7a20e1c7af51ef46258b
wpt-pr: 15188

UltraBlame original commit: eca5d888e47f18532896f5671d22f463fab67bf5

…ener support, a=testonly

Automatic update from web-platform-tests
HTML: target=_blank implies noopener; opener support (#15188)

For whatwg/html#4330.
--

wpt-commits: e81ca209b45fbe73c1bb7a20e1c7af51ef46258b
wpt-pr: 15188

UltraBlame original commit: eca5d888e47f18532896f5671d22f463fab67bf5

See: whatwg/html#4330

Removed the wordings that could imply the behavior is vendor-specific.
Added links to Browser compatibility for easy reference.

* <a target="_blank"> has implicit noopener as per spec.
See: whatwg/html#4330

Removed the wordings that could imply the behavior is vendor-specific.
Added links to Browser compatibility for easy reference.

* <a>: Merged the two similar notes, added more links.

* <area> <form>: Applied the same from 517d127 and c531fc3.
Should follow up when browser-compat-data for form is revised.

* <a> <area> <form>: Applied the new note box style.

refer whatwg/html#4330
https://mathiasbynens.github.io/rel-noopener/

* <a target="_blank"> has implicit noopener as per spec.
See: whatwg/html#4330

Removed the wordings that could imply the behavior is vendor-specific.
Added links to Browser compatibility for easy reference.

* <a>: Merged the two similar notes, added more links.

* <area> <form>: Applied the same from 517d127 and c531fc3.
Should follow up when browser-compat-data for form is revised.

* <a> <area> <form>: Applied the new note box style.

…ener support, a=testonly

Automatic update from web-platform-tests
HTML: target=_blank implies noopener; opener support (#15188)

For whatwg/html#4330.
--

wpt-commits: e81ca209b45fbe73c1bb7a20e1c7af51ef46258b
wpt-pr: 15188

Since whatwg#4330 made target=_blank imply noopener=true, the one permitted
sandboxed navigator is never set for sandboxed iframe popups because
it was inside the noopener=false (Otherwise) branch.

This moves it outside both branches so it runs regardless of noopener,
matching Firefox's implementation and the existing placement of the
sandbox-propagates-to-auxiliary step.

Fixes whatwg#12297

…and images from other websites (#1294)

Jira:
[RSDEV-1604](https://researchspace.atlassian.net/browse/RSDEV-1604)

## What was wrong

Inventory descriptions were displayed with DOMPurify's default
allow-list, which removes scripts but keeps forms, text and password
boxes, buttons and images. A description imported by CSV, written
through the API or copied from the PIDINST registry could therefore show
a working "sign in again" form that posts to another website, or load a
tracking image from another website, on the item's Details, in its info
card and on the public page of an Instrument with a published
identifier. A stored link could also carry `rel="opener"` or a named
target, which lets the website it opens replace the RSpace tab with a
fake sign-in page. Subsample notes, extra text fields and template text
fields use the same read-only view.

## What changes for users

- These fields now display only the formatting the Inventory editor
offers or keeps from pasted text: paragraphs, headings, preformatted
text, bold, italic, underline, strikethrough, superscript, subscript,
text and highlight colour, alignment, indentation, links (including
new-tab links), and bulleted and numbered lists, including where a
numbered list starts and whether it counts down or uses letters.
- Anything else is dropped and its text is kept. The bug's example now
shows the two sentences and the word "Sign in" as plain text, with no
password box, button or image.
- A link that opens in a new tab no longer gives the website it opens
control of the RSpace tab. A link stored to open in a named window opens
in the same tab instead; links written by the editor are unchanged.
- This applies to text saved before the fix too. Nothing stored changes,
and the API still returns descriptions as they were sent.
- The editor is unchanged. Content pasted into it beyond the formatting
above still shows while editing, and only its text shows after saving.

## How

- New `components/Inputs/inventoryRichText.ts`:
`sanitizeInventoryRichText(html)` runs DOMPurify with an allow-list of
tags (`p h1-h6 pre br strong em b i u s del sub sup span a ul ol li`)
and attributes (`href target rel title style`, plus `start reversed type
value` for list numbering), with no `data-*` or `aria-*`.
- The read-only branch of `components/Inputs/TextField.tsx` (item page,
public page, notes, extra and template text fields) and
`Inventory/components/RecordDetails.tsx` (info card, move instructions)
call it instead of `DOMPurify.sanitize(value, { ADD_ATTR: ["target"]
})`.
- A second hook on the same private instance replaces any `opener`
relation with `noopener` on every `_blank` link, keeping its other
relations such as `noreferrer` (target and relations matched
case-insensitively), and removes any other `target`. Browsers cut
`window.opener` automatically only for `_blank`, and `rel="opener"`
restores it ([WHATWG](whatwg/html#4330),
[MDN](https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/rel/noopener)).
- The info card's `dd.below img` CSS is removed, since images no longer
render there.
- `CONTEXT.md`: new glossary term **Inventory rich text**.

## Changes beyond the ticket

Items 1 and 2 are in commit 2 and were agreed during review of the
plan's output. Item 3 is in commits 4 and 5 and came from the internal
security and frontend reviewers. All three are now covered by the
ticket's AC1, AC4 and AC6.

1. **Superscript, subscript and strikethrough are kept** (`sub`, `sup`,
`s`, `del`). The toolbar has no buttons for them, but they rendered
before this change and arrive by paste, the API and CSV import. A
toolbar-only list turned `10<sup>-3</sup>` into "10-3" and struck-out
text into current text. Covered by the "keeps superscript and subscript"
and "keeps strikethrough" cases.
2. **`style` keeps only five properties**: `background-color`, `color`,
`text-decoration`, `text-align`, `padding-left`. Before, any style
survived, so `background-image: url(https://...)` or `image-set(...)`
still loaded an image from another website, and `position: fixed` could
cover the page. The filter is a hook on a private DOMPurify instance, so
the ELN callers keep DOMPurify's defaults. It matches declarations by
property name, ignoring case as CSS does, rather than re-serialising
through the CSSOM, so it behaves the same in every browser and stored
colours display as written. None of the five properties can load a URL.
Covered by the five style "drops" cases and the text colour, alignment
and indentation "keeps" cases.
3. **Links can no longer give the website they open control of the
RSpace tab** (commit 4). A link written through the API or CSV import
could carry `rel="opener"` or a named target, and the opened website
could then replace the RSpace tab with a fake sign-in page. This was
possible before this PR too. Every new-tab link now has any `opener`
relation replaced by `noopener`, keeping its other relations such as
`noreferrer`, and any other target is removed, so such a link opens in
the same tab. Covered by the four link "drops" cases and the "a new-tab
link that hides the referrer" case; the "a link that opens in a new tab"
case shows editor-written links are unchanged.

## Existing tests changed

None. `IdentifierPublicPage.test.tsx` gains one test; everything else is
new.

## Tests

| Test | Pins |
|---|---|
| `inventoryRichText.test.ts` (58) | the bug's description; each dropped
element, attribute and style keeps its text; a stored opener
relationship and a named target are removed from links while other link
relations are kept; each kind of formatting, list numbering and
upper-case style names are kept unchanged; a bare `<` stays text; an
empty string; pages that use DOMPurify's shared instance keep its
defaults |
| `TextField.test.tsx` (1) | the read-only field shows the bug's
description, without its Sign in button |
| `IdentifierPublicPage.test.tsx` (+1) | the public page shows the
description, without its Sign in button |
| `RecordDetails.test.tsx` (1) | the info card shows the description,
without its Sign in button |

The page tests only show that each page goes through the sanitiser; the
exact output for every kind of markup is pinned in the unit table.

Run locally: the six affected test files 67/67, the full jsdom suite 480
files / 3253 tests, `InfoCard.spec.tsx` in Chromium, Firefox and WebKit,
`pnpm tsc` and `pnpm lint` clean. Each new test failed before its fix,
except the colour, alignment and indentation cases, which guard against
the style filter being too strict. Nineteen mutation checks (reverting
each guard in turn, including each call site) all turned tests red. Not
yet checked live on the dev stack.

## Not in this PR

- Cleaning descriptions when they are saved, or a jsoup safelist for
Inventory: display-side only, so stored text and the API are unchanged.
- Escaping plain-text descriptions copied from the PIDINST registry.
- TinyMCE configuration: pasted tables and images still show while
editing.
- `div` and `address` blocks from TinyMCE keyboard shortcuts show as
text without their block break.
- ELN pages that render HTML (RSDEV-1337).
- Help pages: none need changing; the displayed formatting matches what
the editor offers.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 <[email protected]>