updates external links by adding rel

[sornekian]

Fixes #5673

What changes did you make?

• Added "rel="noopener noreferrer"" to code on the About page under Sponsors.

Why did you make the changes (we will use this info to test)?

• Original code line required this addition because it does not specify link type. This line was added so that it could access the DOM of the origin page.

Screenshots of Proposed Changes Of The Website (if any, please do not screen shot code changes)

Visuals before changes are applied

Visuals after changes are applied

[github-actions]

Want to review this pull request? Take a look at this documentation for a step by step guide!

From your project repository, check out a new branch and test the changes.

git checkout -b sornekian-resolve-codeql-5673 gh-pages
git pull https://github.com/sornekian/website.git resolve-codeql-5673

---

Note that CONTRIBUTING.md cannot previewed locally; rather it should be previewed at this URL:

https://github.com/sornekian/website/blob/resolve-codeql-5673/CONTRIBUTING.md  

[freaky4wrld]

Availability: Evenings
ETA: EOD 12/6/23

[jphamtv]

Availability: Monday-Friday 12–2 PM, 8–10 PM (PST)
Estimated ETA: 12/06/23

[freaky4wrld]

Hi there @sornekian , great work there all the work assigned to you in the issue is done correctly

• the to/from branch looks good
• the visual changes are completely applied in the local environment and are responsive
• the changes specified in the CodeQL is done correctly and looks good
• the issue linked is correct too

Great work there, I approve this PR.......

[jphamtv]

Hey @sornekian, I've reviewed the changes in your branch and confirm that the code added to resolve the issue is correct, clean, and does not affect the visuals on the About page. PR is approved, nice job!

I noticed that the for loop for dynamic sponsor element creation is currently commented out, and sponsor links are manually added below. Assuming these are for testing, as the site doesn't have a public link to the page yet, they lack the rel="noopener noreferrer" attribute. It might be good to mention this on the issue page, recommending to address this before the page goes live.

[t-will-gillis]

Hey @sornekian - Great job on the PR!

@jphamtv Saw your comment about the sponsor links on lines 15, 18, and 21. I.e. should these also have the rel="noopener noreferrer" since these are similar links?

Good observation and thanks for bringing up the question. I was curious about why CodeQL was not flagging these links- I am guessing that CodeQL is not explicitly scanning HTML, only the embedded Liquid snippets, but I could be wrong. I would agree that if we are fixing one link we should fix the others. (Incidentally the article attached to the CodeQL alert says that modern browsers (2021+) have addressed this previous vulnerability.) I will put this on the list to discuss with @roslynwythe - January sometime.

[jphamtv]

Thanks @t-will-gillis !