[PM-6328] Checkmarx - Resolve warnings (#7941)

2024-02-15 22:25:53 +01:00 · 2024-02-15 22:25:53 +01:00 · 02dde0c0d3
parent c8c1ed42ba
commit 02dde0c0d3
49 changed files with 101 additions and 85 deletions
--- a/apps/browser/src/auth/popup/register.component.html
+++ b/apps/browser/src/auth/popup/register.component.html
@ -132,11 +132,11 @@
          <input type="checkbox" id="acceptPolicies" formControlName="acceptPolicies" />
          <label for="acceptPolicies">
            {{ "acceptPolicies" | i18n }}<br />
-            <a href="https://bitwarden.com/terms/" target="_blank" rel="noopener">{{
+            <a href="https://bitwarden.com/terms/" target="_blank" rel="noreferrer">{{
              "termsOfService" | i18n
            }}</a
            >,
-            <a href="https://bitwarden.com/privacy/" target="_blank" rel="noopener">{{
+            <a href="https://bitwarden.com/privacy/" target="_blank" rel="noreferrer">{{
              "privacyPolicy" | i18n
            }}</a>
          </label>
--- a/apps/browser/src/autofill/notification/bar.html
+++ b/apps/browser/src/autofill/notification/bar.html
@ -8,7 +8,7 @@
  <body>
    <div class="outer-wrapper">
      <div class="logo">
-        <a href="https://vault.bitwarden.com" target="_blank" id="logo-link">
+        <a href="https://vault.bitwarden.com" target="_blank" id="logo-link" rel="noreferrer">
          <img id="logo" alt="Bitwarden" />
        </a>
      </div>
--- a/apps/browser/src/autofill/popup/settings/autofill.component.html
+++ b/apps/browser/src/autofill/popup/settings/autofill.component.html
@ -67,7 +67,7 @@
        [attr.href]="disablePasswordManagerLink"
        (click)="openDisablePasswordManagerLink($event)"
        target="_blank"
-        rel="noopener noreferrer"
+        rel="noreferrer"
      >
        {{ "turnOffBrowserBuiltInPasswordManagerSettingsLink" | i18n }}
      </a>
@ -90,11 +90,7 @@
      {{ "enableAutoFillOnPageLoadDesc" | i18n }}
      <b>{{ "warning" | i18n }}</b
      >: {{ "experimentalFeature" | i18n }}
-      <a
-        href="https://bitwarden.com/help/auto-fill-browser/"
-        target="_blank"
-        rel="noopener noreferrer"
-      >
+      <a href="https://bitwarden.com/help/auto-fill-browser/" target="_blank" rel="noreferrer">
        {{ "learnMoreAboutAutofill" | i18n }}.
        <i
          [attr.aria-label]="'opensInANewWindow' | i18n"
--- a/apps/browser/src/popup/components/private-mode-warning.component.html
+++ b/apps/browser/src/popup/components/private-mode-warning.component.html
@ -1,6 +1,6 @@
 <app-callout class="app-private-mode-warning" type="warning" *ngIf="showWarning">
  {{ "privateModeWarning" | i18n }}
-  <a href="https://bitwarden.com/help/article/private-mode/" target="_blank" rel="noopener">{{
+  <a href="https://bitwarden.com/help/article/private-mode/" target="_blank" rel="noreferrer">{{
    "learnMore" | i18n
  }}</a>
 </app-callout>
--- a/apps/browser/src/tools/popup/generator/generator.component.html
+++ b/apps/browser/src/tools/popup/generator/generator.component.html
@ -309,7 +309,7 @@
            <a
              href="https://bitwarden.com/help/generator/#username-types"
              target="_blank"
-              rel="noopener"
+              rel="noreferrer"
              appA11yTitle="{{ 'learnMore' | i18n }}"
            >
              <i class="bwi bwi-question-circle" aria-hidden="true"></i>
--- a/apps/browser/src/vault/popup/components/vault/add-edit.component.html
+++ b/apps/browser/src/vault/popup/components/vault/add-edit.component.html
@ -657,7 +657,7 @@
            {{ "passwordPrompt" | i18n }}
            <a
              target="_blank"
-              rel="noopener"
+              rel="noreferrer"
              appA11yTitle="{{ 'learnMore' | i18n }}"
              href="https://bitwarden.com/help/managing-items/#protect-individual-items"
            >
--- a/apps/desktop/src/auth/register.component.html
+++ b/apps/desktop/src/auth/register.component.html
@ -129,11 +129,11 @@
        <input type="checkbox" id="acceptPolicies" formControlName="acceptPolicies" />
        <label for="acceptPolicies">
          {{ "acceptPolicies" | i18n }}<br />
-          <a href="https://bitwarden.com/terms/" target="_blank" rel="noopener">{{
+          <a href="https://bitwarden.com/terms/" target="_blank" rel="noreferrer">{{
            "termsOfService" | i18n
          }}</a
          >,
-          <a href="https://bitwarden.com/privacy/" target="_blank" rel="noopener">{{
+          <a href="https://bitwarden.com/privacy/" target="_blank" rel="noreferrer">{{
            "privacyPolicy" | i18n
          }}</a>
        </label>
--- a/apps/web/src/app/admin-console/organizations/manage/user-confirm.component.html
+++ b/apps/web/src/app/admin-console/organizations/manage/user-confirm.component.html
@ -18,7 +18,7 @@
      <div class="modal-body">
        <p>
          {{ "fingerprintEnsureIntegrityVerify" | i18n }}
-          <a href="https://bitwarden.com/help/fingerprint-phrase/" target="_blank" rel="noopener">
+          <a href="https://bitwarden.com/help/fingerprint-phrase/" target="_blank" rel="noreferrer">
            {{ "learnMore" | i18n }}</a
          >
        </p>
--- a/apps/web/src/app/admin-console/organizations/members/components/bulk/bulk-confirm.component.html
+++ b/apps/web/src/app/admin-console/organizations/members/components/bulk/bulk-confirm.component.html
@ -28,7 +28,11 @@
        <ng-container *ngIf="!loading && !done">
          <p>
            {{ "fingerprintEnsureIntegrityVerify" | i18n }}
-            <a href="https://bitwarden.com/help/fingerprint-phrase/" target="_blank" rel="noopener">
+            <a
+              href="https://bitwarden.com/help/fingerprint-phrase/"
+              target="_blank"
+              rel="noreferrer"
+            >
              {{ "learnMore" | i18n }}</a
            >
          </p>
--- a/apps/web/src/app/admin-console/organizations/members/components/member-dialog/member-dialog.component.html
+++ b/apps/web/src/app/admin-console/organizations/members/components/member-dialog/member-dialog.component.html
@ -37,7 +37,7 @@
              {{ "memberRole" | i18n }}
              <a
                target="_blank"
-                rel="noopener"
+                rel="noreferrer"
                appA11yTitle="{{ 'learnMore' | i18n }}"
                href="https://bitwarden.com/help/user-types-access-control/"
              >
@ -123,7 +123,7 @@
                <ng-container *ngIf="!canUseCustomPermissions; else enterprise">
                  <div class="text-base tw-block tw-font-normal tw-text-muted">
                    {{ "customDescNonEnterpriseStart" | i18n
-                    }}<a href="https://bitwarden.com/contact/" target="_blank">{{
+                    }}<a href="https://bitwarden.com/contact/" target="_blank" rel="noreferrer">{{
                      "customDescNonEnterpriseLink" | i18n
                    }}</a
                    >{{ "customDescNonEnterpriseEnd" | i18n }}
@ -370,7 +370,7 @@
              {{ "secretsManager" | i18n }}
              <a
                target="_blank"
-                rel="noopener"
+                rel="noreferrer"
                appA11yTitle="{{ 'learnMore' | i18n }}"
                href="https://bitwarden.com/help/manage-your-organization/#access-to-secrets-manager"
              >
@ -415,7 +415,7 @@
                {{ "accessAllCollectionsDesc" | i18n }}
                <a
                  target="_blank"
-                  rel="noopener"
+                  rel="noreferrer"
                  appA11yTitle="{{ 'learnMore' | i18n }}"
                  href="https://bitwarden.com/help/user-types-access-control/#access-control"
                >
--- a/apps/web/src/app/admin-console/organizations/settings/account.component.html
+++ b/apps/web/src/app/admin-console/organizations/settings/account.component.html
@ -41,7 +41,7 @@
  <h1 bitTypography="h1" class="tw-mt-16 tw-pb-2.5">{{ "apiKey" | i18n }}</h1>
  <p>
    {{ "apiKeyDesc" | i18n }}
-    <a href="https://docs.bitwarden.com" target="_blank" rel="noopener">
+    <a href="https://docs.bitwarden.com" target="_blank" rel="noreferrer">
      {{ "learnMore" | i18n }}
    </a>
  </p>
@ -62,7 +62,7 @@
  </h1>
  <p>
    {{ "collectionEnhancementsDesc" | i18n }}
-    <a href="https://bitwarden.com/help/collection-management" target="_blank" rel="noopener">
+    <a href="https://bitwarden.com/help/collection-management" target="_blank" rel="noreferrer">
      {{ "collectionEnhancementsLearnMore" | i18n }}
    </a>
  </p>
--- a/apps/web/src/app/auth/migrate-encryption/migrate-legacy-encryption.component.html
+++ b/apps/web/src/app/auth/migrate-encryption/migrate-legacy-encryption.component.html
@ -10,7 +10,7 @@
          <a
            href="https://bitwarden.com/help/account-encryption-key/#rotate-your-encryption-key"
            target="_blank"
-            rel="noopener"
+            rel="noreferrer"
            >{{ "learnMore" | i18n }}</a
          >
        </p>
--- a/apps/web/src/app/auth/recover-two-factor.component.html
+++ b/apps/web/src/app/auth/recover-two-factor.component.html
@ -9,7 +9,7 @@
            <a
              href="https://bitwarden.com/help/lost-two-step-device/"
              target="_blank"
-              rel="noopener"
+              rel="noreferrer"
              >{{ "learnMore" | i18n }}</a
            >
          </p>
--- a/apps/web/src/app/auth/register-form/register-form.component.html
+++ b/apps/web/src/app/auth/register-form/register-form.component.html
@ -115,11 +115,11 @@

      <bit-label for="register-form-input-accept-policies">
        {{ "acceptPolicies" | i18n }}<br />
-        <a href="https://bitwarden.com/terms/" target="_blank" rel="noopener">{{
+        <a href="https://bitwarden.com/terms/" target="_blank" rel="noreferrer">{{
          "termsOfService" | i18n
        }}</a
        >,
-        <a href="https://bitwarden.com/privacy/" target="_blank" rel="noopener">{{
+        <a href="https://bitwarden.com/privacy/" target="_blank" rel="noreferrer">{{
          "privacyPolicy" | i18n
        }}</a>
      </bit-label>
--- a/apps/web/src/app/auth/settings/change-password.component.html
+++ b/apps/web/src/app/auth/settings/change-password.component.html
@ -103,7 +103,7 @@
      <a
        href="https://bitwarden.com/help/account-encryption-key/#rotate-your-encryption-key"
        target="_blank"
-        rel="noopener"
+        rel="noreferrer"
        appA11yTitle="{{ 'learnMore' | i18n }}"
      >
        <i class="bwi bwi-question-circle" aria-hidden="true"></i>
--- a/apps/web/src/app/auth/settings/emergency-access/confirm/emergency-access-confirm.component.html
+++ b/apps/web/src/app/auth/settings/emergency-access/confirm/emergency-access-confirm.component.html
@ -18,7 +18,7 @@
      <div class="modal-body">
        <p>
          {{ "fingerprintEnsureIntegrityVerify" | i18n }}
-          <a href="https://bitwarden.com/help/fingerprint-phrase/" target="_blank" rel="noopener">
+          <a href="https://bitwarden.com/help/fingerprint-phrase/" target="_blank" rel="noreferrer">
            {{ "learnMore" | i18n }}</a
          >
        </p>
--- a/apps/web/src/app/auth/settings/emergency-access/emergency-access-add-edit.component.html
+++ b/apps/web/src/app/auth/settings/emergency-access/emergency-access-add-edit.component.html
@ -49,7 +49,7 @@
          {{ "userAccess" | i18n }}
          <a
            target="_blank"
-            rel="noopener"
+            rel="noreferrer"
            appA11yTitle="{{ 'learnMore' | i18n }}"
            href="https://bitwarden.com/help/emergency-access/#user-access"
          >
--- a/apps/web/src/app/auth/settings/emergency-access/emergency-access.component.html
+++ b/apps/web/src/app/auth/settings/emergency-access/emergency-access.component.html
@ -3,7 +3,7 @@
 </div>
 <p>
  {{ "emergencyAccessDesc" | i18n }}
-  <a href="https://bitwarden.com/help/emergency-access/" target="_blank" rel="noopener">
+  <a href="https://bitwarden.com/help/emergency-access/" target="_blank" rel="noreferrer">
    {{ "learnMore" | i18n }}.
  </a>
 </p>
--- a/apps/web/src/app/auth/settings/security/change-kdf/change-kdf.component.html
+++ b/apps/web/src/app/auth/settings/security/change-kdf/change-kdf.component.html
@ -11,7 +11,7 @@
          class="ml-auto"
          href="https://bitwarden.com/help/kdf-algorithms"
          target="_blank"
-          rel="noopener"
+          rel="noreferrer"
          appA11yTitle="{{ 'learnMore' | i18n }}"
        >
          <i class="bwi bwi-question-circle" aria-hidden="true"></i>
@ -49,7 +49,7 @@
            class="ml-auto"
            href="https://bitwarden.com/help/what-encryption-is-used/#changing-kdf-iterations"
            target="_blank"
-            rel="noopener"
+            rel="noreferrer"
            appA11yTitle="{{ 'learnMore' | i18n }}"
          >
            <i class="bwi bwi-question-circle" aria-hidden="true"></i>
--- a/apps/web/src/app/auth/settings/two-factor-authenticator.component.html
+++ b/apps/web/src/app/auth/settings/two-factor-authenticator.component.html
@ -51,7 +51,7 @@
              <a
                href="https://itunes.apple.com/us/app/authy/id494168017?mt=8"
                target="_blank"
-                rel="noopener"
+                rel="noreferrer"
                >Authy</a
              >
            </li>
@ -60,7 +60,7 @@
              <a
                href="https://play.google.com/store/apps/details?id=com.authy.authy"
                target="_blank"
-                rel="noopener"
+                rel="noreferrer"
                >Authy</a
              >
            </li>
@ -69,7 +69,7 @@
              <a
                href="https://www.microsoft.com/p/authenticator/9wzdncrfj3rj"
                target="_blank"
-                rel="noopener"
+                rel="noreferrer"
                >Microsoft Authenticator</a
              >
            </li>
--- a/apps/web/src/app/billing/individual/premium.component.html
+++ b/apps/web/src/app/billing/individual/premium.component.html
@ -56,7 +56,7 @@
    bitButton
    href="{{ this.cloudWebVaultUrl }}/#/settings/subscription/premium"
    target="_blank"
-    rel="noopener"
+    rel="noreferrer"
    buttonType="secondary"
    *ngIf="selfHosted"
  >
--- a/apps/web/src/app/billing/individual/user-subscription.component.html
+++ b/apps/web/src/app/billing/individual/user-subscription.component.html
@ -104,7 +104,7 @@
        buttonType="secondary"
        href="{{ this.cloudWebVaultUrl }}/#/settings/subscription"
        target="_blank"
-        rel="noopener"
+        rel="noreferrer"
      >
        {{ "launchCloudSubscription" | i18n }}
      </a>
--- a/apps/web/src/app/billing/organizations/download-license.component.html
+++ b/apps/web/src/app/billing/organizations/download-license.component.html
@ -11,7 +11,7 @@
          <a
            class="ml-auto"
            target="_blank"
-            rel="noopener"
+            rel="noreferrer"
            appA11yTitle="{{ 'learnMore' | i18n }}"
            href="https://bitwarden.com/help/licensing-on-premise/#organization-account-sharing"
          >
--- a/apps/web/src/app/billing/organizations/organization-subscription-selfhost.component.html
+++ b/apps/web/src/app/billing/organizations/organization-subscription-selfhost.component.html
@ -40,7 +40,7 @@
        href="https://bitwarden.com/help/licensing-on-premise/#update-organization-license"
        target="_blank"
        [appA11yTitle]="'licensePaidFeaturesHelp' | i18n"
-        rel="noopener"
+        rel="noreferrer"
      >
        <i class="bwi bwi-question-circle" aria-hidden="true"></i>
        <span class="sr-only">{{ "licensePaidFeaturesHelp" | i18n }}</span>
@ -68,7 +68,7 @@
    buttonType="secondary"
    href="{{ this.cloudWebVaultUrl }}"
    target="_blank"
-    rel="noopener"
+    rel="noreferrer"
  >
    {{ "launchCloudSubscription" | i18n }}
  </a>
@ -88,7 +88,7 @@
          <a
            href="https://bitwarden.com/help/families-for-enterprise-self-hosted/"
            target="_blank"
-            rel="noopener"
+            rel="noreferrer"
          >
            <i class="bwi bwi-question-circle" aria-hidden="true"></i>
            <span class="sr-only">{{ "billingSyncHelp" | i18n }}</span>
--- a/apps/web/src/app/billing/shared/billing-history.component.html
+++ b/apps/web/src/app/billing/shared/billing-history.component.html
@ -8,13 +8,13 @@
        <a
          href="{{ i.pdfUrl }}"
          target="_blank"
-          rel="noopener"
+          rel="noreferrer"
          class="mr-2"
          appA11yTitle="{{ 'downloadInvoice' | i18n }}"
        >
          <i class="bwi bwi-file-pdf" aria-hidden="true"></i
        ></a>
-        <a href="{{ i.url }}" target="_blank" rel="noopener" title="{{ 'viewInvoice' | i18n }}">
+        <a href="{{ i.url }}" target="_blank" rel="noreferrer" title="{{ 'viewInvoice' | i18n }}">
          {{ "invoiceNumber" | i18n: i.number }}</a
        >
      </td>
--- a/apps/web/src/app/billing/shared/payment.component.html
+++ b/apps/web/src/app/billing/shared/payment.component.html
@ -83,7 +83,7 @@
          href="https://www.cvvnumber.com/cvv.html"
          tabindex="-1"
          target="_blank"
-          rel="noopener noreferrer"
+          rel="noreferrer"
          class="ml-auto"
          appA11yTitle="{{ 'learnMore' | i18n }}"
        >
--- a/apps/web/src/app/layouts/header/web-header.component.html
+++ b/apps/web/src/app/layouts/header/web-header.component.html
@ -61,11 +61,16 @@
                <i class="bwi bwi-fw bwi-user" aria-hidden="true"></i>
                {{ "accountSettings" | i18n }}
              </a>
-              <a bitMenuItem href="https://bitwarden.com/help/" target="_blank" rel="noopener">
+              <a bitMenuItem href="https://bitwarden.com/help/" target="_blank" rel="noreferrer">
                <i class="bwi bwi-fw bwi-question-circle" aria-hidden="true"></i>
                {{ "getHelp" | i18n }}
              </a>
-              <a bitMenuItem href="https://bitwarden.com/download/" target="_blank" rel="noopener">
+              <a
+                bitMenuItem
+                href="https://bitwarden.com/download/"
+                target="_blank"
+                rel="noreferrer"
+              >
                <i class="bwi bwi-fw bwi-download" aria-hidden="true"></i>
                {{ "getApps" | i18n }}
              </a>
--- a/apps/web/src/app/layouts/navbar.component.html
+++ b/apps/web/src/app/layouts/navbar.component.html
@ -75,11 +75,11 @@
              <i class="bwi bwi-fw bwi-user" aria-hidden="true"></i>
              {{ "accountSettings" | i18n }}
            </a>
-            <a bitMenuItem href="https://bitwarden.com/help/" target="_blank" rel="noopener">
+            <a bitMenuItem href="https://bitwarden.com/help/" target="_blank" rel="noreferrer">
              <i class="bwi bwi-fw bwi-question-circle" aria-hidden="true"></i>
              {{ "getHelp" | i18n }}
            </a>
-            <a bitMenuItem href="https://bitwarden.com/download/" target="_blank" rel="noopener">
+            <a bitMenuItem href="https://bitwarden.com/download/" target="_blank" rel="noreferrer">
              <i class="bwi bwi-fw bwi-download" aria-hidden="true"></i>
              {{ "getApps" | i18n }}
            </a>
--- a/apps/web/src/app/layouts/product-switcher/product-switcher-content.component.html
+++ b/apps/web/src/app/layouts/product-switcher/product-switcher-content.component.html
@ -38,7 +38,7 @@
        bitLink
        [href]="product.marketingRoute"
        target="_blank"
-        rel="noopener noreferrer"
+        rel="noreferrer"
      >
        <span class="tw-flex tw-items-center tw-font-normal">
          <i class="bwi bwi-fw {{ product.icon }} tw-m-0 !tw-mr-3"></i>{{ product.name }}
--- a/apps/web/src/app/settings/preferences.component.html
+++ b/apps/web/src/app/settings/preferences.component.html
@ -75,7 +75,7 @@
            class="ml-auto"
            href="https://bitwarden.com/help/localization/"
            target="_blank"
-            rel="noopener"
+            rel="noreferrer"
            appA11yTitle="{{ 'learnMore' | i18n }}"
          >
            <i class="bwi bwi-question-circle" aria-hidden="true"></i>
@ -103,7 +103,7 @@
      <a
        href="https://bitwarden.com/help/website-icons/"
        target="_blank"
-        rel="noopener"
+        rel="noreferrer"
        appA11yTitle="{{ 'learnMore' | i18n }}"
      >
        <i class="bwi bwi-question-circle" aria-hidden="true"></i>
--- a/apps/web/src/app/shared/components/account-fingerprint/account-fingerprint.component.html
+++ b/apps/web/src/app/shared/components/account-fingerprint/account-fingerprint.component.html
@ -5,7 +5,7 @@
    <a
      href="https://bitwarden.com/help/fingerprint-phrase/"
      target="_blank"
-      rel="noopener"
+      rel="noreferrer"
      appA11yTitle="{{ 'learnMore' | i18n }}"
    >
      <i class="bwi bwi-question-circle" aria-hidden="true"></i
--- a/apps/web/src/app/tools/generator.component.html
+++ b/apps/web/src/app/tools/generator.component.html
@ -253,7 +253,7 @@
        class="ml-auto"
        href="https://bitwarden.com/help/generator/#username-types"
        target="_blank"
-        rel="noopener"
+        rel="noreferrer"
        appA11yTitle="{{ 'learnMore' | i18n }}"
      >
        <i class="bwi bwi-question-circle" aria-hidden="true"></i>
--- a/apps/web/src/app/tools/reports/pages/inactive-two-factor-report.component.html
+++ b/apps/web/src/app/tools/reports/pages/inactive-two-factor-report.component.html
@ -74,7 +74,7 @@
              bitBadge
              href="{{ cipherDocs.get(c.id) }}"
              target="_blank"
-              rel="noopener"
+              rel="noreferrer"
              *ngIf="cipherDocs.has(c.id)"
            >
              {{ "instructions" | i18n }}</a
--- a/apps/web/src/app/tools/send/access.component.html
+++ b/apps/web/src/app/tools/send/access.component.html
@ -11,12 +11,9 @@
    </div>
    <bit-callout *ngIf="hideEmail" type="warning" title="{{ 'warning' | i18n }}">
      {{ "viewSendHiddenEmailWarning" | i18n }}
-      <a
-        bitLink
-        href="https://bitwarden.com/help/receive-send/"
-        target="_blank"
-        rel="noopener noreferrer"
-        >{{ "learnMore" | i18n }}</a
+      <a bitLink href="https://bitwarden.com/help/receive-send/" target="_blank" rel="noreferrer">{{
+        "learnMore" | i18n
+      }}</a
      >.
    </bit-callout>
    <div
@ -74,7 +71,7 @@
          bitLink
          href="https://www.bitwarden.com/products/send?source=web-vault"
          target="_blank"
-          rel="noopener noreferrer"
+          rel="noreferrer"
          >Bitwarden Send</a
        >
        {{ "sendAccessTaglineOr" | i18n }}
--- a/apps/web/src/app/vault/components/vault-items/vault-cipher-row.component.html
+++ b/apps/web/src/app/vault/components/vault-items/vault-cipher-row.component.html
@ -96,6 +96,7 @@
        type="button"
        [href]="cipher.login.launchUri"
        target="_blank"
+        rel="noreferrer"
      >
        <i class="bwi bwi-fw bwi-share-square" aria-hidden="true"></i>
        {{ "launch" | i18n }}
--- a/apps/web/src/app/vault/individual-vault/add-edit-custom-fields.component.html
+++ b/apps/web/src/app/vault/individual-vault/add-edit-custom-fields.component.html
@ -15,7 +15,7 @@
            class="ml-auto"
            href="https://bitwarden.com/help/custom-fields/"
            target="_blank"
-            rel="noopener"
+            rel="noreferrer"
            appA11yTitle="{{ 'learnMore' | i18n }}"
          >
            <i class="bwi bwi-question-circle" aria-hidden="true"></i>
--- a/apps/web/src/app/vault/individual-vault/add-edit.component.html
+++ b/apps/web/src/app/vault/individual-vault/add-edit.component.html
@ -372,7 +372,7 @@
                    class="ml-auto"
                    href="https://bitwarden.com/help/uri-match-detection/"
                    target="_blank"
-                    rel="noopener"
+                    rel="noreferrer"
                    appA11yTitle="{{ 'learnMore' | i18n }}"
                  >
                    <i class="bwi bwi-question-circle" aria-hidden="true"></i>
@ -940,7 +940,7 @@
            }}</label>
            <a
              target="_blank"
-              rel="noopener"
+              rel="noreferrer"
              appA11yTitle="{{ 'learnMore' | i18n }}"
              href="https://bitwarden.com/help/managing-items/#protect-individual-items"
            >
--- a/apps/web/src/app/vault/individual-vault/attachments.component.html
+++ b/apps/web/src/app/vault/individual-vault/attachments.component.html
@ -44,7 +44,7 @@
                    <a
                      href="https://bitwarden.com/help/attachments/#fixing-old-attachments"
                      target="_blank"
-                      rel="noopener"
+                      rel="noreferrer"
                    >
                      <i
                        class="bwi bwi-exclamation-triangle text-warning"
--- a/apps/web/src/app/vault/individual-vault/vault-filter/components/vault-filter.component.html
+++ b/apps/web/src/app/vault/individual-vault/vault-filter/components/vault-filter.component.html
@ -9,7 +9,7 @@
        class="ml-auto"
        href="https://bitwarden.com/help/searching-vault/"
        target="_blank"
-        rel="noopener"
+        rel="noreferrer"
        appA11yTitle="{{ 'learnMore' | i18n }}"
      >
        <i class="bwi bwi-question-circle" aria-hidden="true"></i>
--- a/apps/web/src/app/vault/individual-vault/vault.component.html
+++ b/apps/web/src/app/vault/individual-vault/vault.component.html
@ -101,7 +101,7 @@
            class="btn btn-block btn-outline-secondary"
            target="_blank"
            href="https://browser-update.org/update-browser.html"
-            rel="noopener"
+            rel="noreferrer"
          >
            {{ "updateBrowser" | i18n }}
          </a>
--- a/bitwarden_license/bit-web/src/app/admin-console/policies/activate-autofill.component.html
+++ b/bitwarden_license/bit-web/src/app/admin-console/policies/activate-autofill.component.html
@ -1,6 +1,6 @@
 <app-callout type="warning">
  {{ "experimentalFeature" | i18n }}
-  <a href="https://bitwarden.com/help/auto-fill-browser/" target="_blank" rel="noopener">{{
+  <a href="https://bitwarden.com/help/auto-fill-browser/" target="_blank" rel="noreferrer">{{
    "learnMoreAboutAutofill" | i18n
  }}</a>
 </app-callout>
--- a/bitwarden_license/bit-web/src/app/admin-console/providers/manage/user-add-edit.component.html
+++ b/bitwarden_license/bit-web/src/app/admin-console/providers/manage/user-add-edit.component.html
@ -50,7 +50,7 @@
          {{ "userType" | i18n }}
          <a
            target="_blank"
-            rel="noopener"
+            rel="noreferrer"
            appA11yTitle="{{ 'learnMore' | i18n }}"
            href="https://bitwarden.com/help/provider-users/"
          >
--- a/bitwarden_license/bit-web/src/app/auth/sso/sso.component.html
+++ b/bitwarden_license/bit-web/src/app/auth/sso/sso.component.html
@ -60,7 +60,7 @@
          {{ "keyConnector" | i18n }}
          <a
            target="_blank"
-            rel="noopener"
+            rel="noreferrer"
            appA11yTitle="{{ 'learnMore' | i18n }}"
            href="https://bitwarden.com/help/about-key-connector/"
          >
--- a/bitwarden_license/bit-web/src/app/secrets-manager/overview/overview.component.html
+++ b/bitwarden_license/bit-web/src/app/secrets-manager/overview/overview.component.html
@ -12,9 +12,13 @@
    >
      <span class="tw-pl-1">
        {{ "downloadThe" | i18n }}
-        <a bitLink href="https://bitwarden.com/help/secrets-manager-cli/" target="_blank">{{
-          "smCLI" | i18n
-        }}</a>
+        <a
+          bitLink
+          href="https://bitwarden.com/help/secrets-manager-cli/"
+          target="_blank"
+          rel="noreferrer"
+          >{{ "smCLI" | i18n }}</a
+        >
      </span>
    </app-onboarding-task>
    <app-onboarding-task
--- a/libs/auth/src/angular/fingerprint-dialog/fingerprint-dialog.component.html
+++ b/libs/auth/src/angular/fingerprint-dialog/fingerprint-dialog.component.html
@ -9,7 +9,7 @@
      bitButton
      href="https://bitwarden.com/help/fingerprint-phrase/"
      target="_blank"
-      rel="noopener"
+      rel="noreferrer"
      buttonType="primary"
      bitDialogClose
    >
--- a/libs/common/src/platform/services/web-crypto-function.service.ts
+++ b/libs/common/src/platform/services/web-crypto-function.service.ts
@ -139,7 +139,7 @@ export class WebCryptoFunctionService implements CryptoFunctionService {
    algorithm: "sha1" | "sha256" | "sha512" | "md5",
  ): Promise<Uint8Array> {
    if (algorithm === "md5") {
-      const md = algorithm === "md5" ? forge.md.md5.create() : forge.md.sha1.create();
+      const md = forge.md.md5.create();
      const valueBytes = this.toByteString(value);
      md.update(valueBytes, "raw");
      return Utils.fromByteStringToArray(md.digest().data);
--- a/libs/components/src/avatar/avatar.component.ts
+++ b/libs/components/src/avatar/avatar.component.ts
@ -75,6 +75,8 @@ export class AvatarComponent implements OnChanges {
    svg.appendChild(charObj);
    const html = window.document.createElement("div").appendChild(svg).outerHTML;
    const svgHtml = window.btoa(unescape(encodeURIComponent(html)));
+
+    // This is safe because the only user provided value, chars is set using `textContent`
    this.src = this.sanitizer.bypassSecurityTrustResourceUrl(
      "data:image/svg+xml;base64," + svgHtml,
    );
@ -117,6 +119,7 @@ export class AvatarComponent implements OnChanges {
      '"Open Sans","Helvetica Neue",Helvetica,Arial,' +
        'sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol"',
    );
+    // Warning do not use innerHTML here, characters are user provided
    textTag.textContent = character;
    textTag.style.fontWeight = this.svgFontWeight.toString();
    textTag.style.fontSize = this.svgFontSize + "px";
--- a/libs/components/src/stories/introduction.mdx
+++ b/libs/components/src/stories/introduction.mdx
@ -104,6 +104,7 @@ component library and the other clients will follow once this work is completed.
    className="link-item"
    href="https://storybook.js.org/docs/react/get-started/setup#configure-storybook-for-your-stack"
    target="_blank"
+    rel="noreferrer"
  >
    <span>
      <strong>Data</strong>
@ -115,13 +116,18 @@ component library and the other clients will follow once this work is completed.
 <div className="subheading">Learn</div>

 <div className="link-list">
-  <a className="link-item" href="https://storybook.js.org/docs" target="_blank">
+  <a className="link-item" href="https://storybook.js.org/docs" target="_blank" rel="noreferrer">
    <span>
      <strong>Storybook documentation</strong>
      Configure, customize, and extend
    </span>
  </a>
-  <a className="link-item" href="https://storybook.js.org/tutorials/" target="_blank">
+  <a
+    className="link-item"
+    href="https://storybook.js.org/tutorials/"
+    target="_blank"
+    rel="noreferrer"
+  >
    <span>
      <strong>In-depth guides</strong>
      Best practices from leading teams
--- a/libs/importer/src/components/import.component.html
+++ b/libs/importer/src/components/import.component.html
@ -7,7 +7,7 @@
      >{{ "importDestination" | i18n }}
      <a
        target="_blank"
-        rel="noopener"
+        rel="noreferrer"
        appA11yTitle="{{ 'learnAboutImportOptions' | i18n }}"
        href="https://bitwarden.com/help/import-data/"
      >
@ -78,14 +78,14 @@
  <bit-callout type="info" title="{{ getFormatInstructionTitle() }}" *ngIf="format">
    <ng-container *ngIf="format === 'bitwardencsv' || format === 'bitwardenjson'">
      See detailed instructions on our help site at
-      <a target="_blank" rel="noopener" href="https://bitwarden.com/help/export-your-data/">
+      <a target="_blank" rel="noreferrer" href="https://bitwarden.com/help/export-your-data/">
        https://bitwarden.com/help/export-your-data/</a
      >
    </ng-container>
    <ng-container *ngIf="format === 'lastpasscsv'">
      <p bitTypography="body1">
        {{ "seeDetailedInstructions" | i18n }}
-        <a target="_blank" rel="noopener" href="https://bitwarden.com/help/import-from-lastpass/">
+        <a target="_blank" rel="noreferrer" href="https://bitwarden.com/help/import-from-lastpass/">
          https://bitwarden.com/help/import-from-lastpass/</a
        >
      </p>
@ -153,19 +153,19 @@
        The process is exactly the same as importing from Google Chrome.
      </span>
      See detailed instructions on our help site at
-      <a target="_blank" rel="noopener" href="https://bitwarden.com/help/import-from-chrome/">
+      <a target="_blank" rel="noreferrer" href="https://bitwarden.com/help/import-from-chrome/">
        https://bitwarden.com/help/import-from-chrome/</a
      >
    </ng-container>
    <ng-container *ngIf="format === 'firefoxcsv'">
      See detailed instructions on our help site at
-      <a target="_blank" rel="noopener" href="https://bitwarden.com/help/import-from-firefox/">
+      <a target="_blank" rel="noreferrer" href="https://bitwarden.com/help/import-from-firefox/">
        https://bitwarden.com/help/import-from-firefox/</a
      >.
    </ng-container>
    <ng-container *ngIf="format === 'safaricsv'">
      See detailed instructions on our help site at
-      <a target="_blank" rel="noopener" href="https://bitwarden.com/help/import-from-safari/">
+      <a target="_blank" rel="noreferrer" href="https://bitwarden.com/help/import-from-safari/">
        https://bitwarden.com/help/import-from-safari/</a
      >.
    </ng-container>
@ -178,7 +178,7 @@
      "
    >
      See detailed instructions on our help site at
-      <a target="_blank" rel="noopener" href="https://bitwarden.com/help/import-from-1password/">
+      <a target="_blank" rel="noreferrer" href="https://bitwarden.com/help/import-from-1password/">
        https://bitwarden.com/help/import-from-1password/</a
      >.
    </ng-container>
@ -264,7 +264,7 @@
    </ng-container>
    <ng-container *ngIf="format === 'gnomejson'">
      Make sure you have python-keyring and python-gnomekeyring installed. Save the
-      <a target="_blank" rel="noopener" href="https://bit.ly/2GpOMTg"
+      <a target="_blank" rel="noreferrer" href="https://bit.ly/2GpOMTg"
        >GNOME Keyring Import/Export</a
      >
      python script to your desktop as <code>pw_helper.py</code>. Open terminal and run