Merge pull request #2688 from Tyriar/2608_safe_links

Handle links safely by removing opener from window

addons/xterm-addon-web-links/src/WebLinksAddon.ts

@@ -26,7 +26,13 @@ const end = ')($|' + negatedPathCharacterSet + ')';
 const strictUrlRegex = new RegExp(start + protocolClause + bodyClause + end);
 
 function handleLink(event: MouseEvent, uri: string): void {
-  window.open(uri, '_blank');
+  const newWindow = window.open();
+  if (newWindow) {
+    newWindow.opener = null;
+    newWindow.location.href = uri;
+  } else {
+    console.warn('Opening link blocked as opener could not be cleared');
+  }
 }
 
 export class WebLinksAddon implements ITerminalAddon {

src/browser/Linkifier.ts

@@ -298,7 +298,13 @@ export class Linkifier implements ILinkifier {
         if (matcher.handler) {
           return matcher.handler(e, uri);
         }
-        window.open(uri, '_blank');
+        const newWindow = window.open();
+        if (newWindow) {
+          newWindow.opener = null;
+          newWindow.location.href = uri;
+        } else {
+          console.warn('Opening link blocked as opener could not be cleared');
+        }
       },
       () => {
         this._onLinkHover.fire(this._createLinkHoverEvent(x1, y1, x2, y2, fg));