From f696f9682486b4af0aaf18eca6ced1a2a4c08dde Mon Sep 17 00:00:00 2001
From: ulmemxpoc <123284914+ulmemxpoc@users.noreply.github.com>
Date: Tue, 30 Apr 2024 03:40:19 +0000
Subject: [PATCH 1/2] Add rel="noreferrer noopener" to external links

---
 src/invidious/frontend/comments_youtube.cr               | 4 ++--
 src/invidious/helpers/errors.cr                          | 2 +-
 src/invidious/views/components/video-context-buttons.ecr | 2 +-
 src/invidious/views/playlist.ecr                         | 2 +-
 src/invidious/views/watch.ecr                            | 6 +++---
 5 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/src/invidious/frontend/comments_youtube.cr b/src/invidious/frontend/comments_youtube.cr
index aecac87f..f9eb44ef 100644
--- a/src/invidious/frontend/comments_youtube.cr
+++ b/src/invidious/frontend/comments_youtube.cr
@@ -149,12 +149,12 @@ module Invidious::Frontend::Comments
 
         if comments["videoId"]?
           html << <<-END_HTML
-            <a href="https://www.youtube.com/watch?v=#{comments["videoId"]}&lc=#{child["commentId"]}" title="#{translate(locale, "YouTube comment permalink")}">[YT]</a>
+            <a rel="noreferrer noopener" href="#{YT_URL.to_s}/watch?v=#{comments["videoId"]}&lc=#{child["commentId"]}" title="#{translate(locale, "YouTube comment permalink")}">[YT]</a>
             |
           END_HTML
         elsif comments["authorId"]?
           html << <<-END_HTML
-            <a href="https://www.youtube.com/channel/#{comments["authorId"]}/community?lb=#{child["commentId"]}" title="#{translate(locale, "YouTube comment permalink")}">[YT]</a>
+            <a rel="noreferrer noopener" href="https://www.youtube.com/channel/#{comments["authorId"]}/community?lb=#{child["commentId"]}" title="#{translate(locale, "YouTube comment permalink")}">[YT]</a>
             |
           END_HTML
         end
diff --git a/src/invidious/helpers/errors.cr b/src/invidious/helpers/errors.cr
index 21b789bc..b2df682d 100644
--- a/src/invidious/helpers/errors.cr
+++ b/src/invidious/helpers/errors.cr
@@ -190,7 +190,7 @@ def error_redirect_helper(env : HTTP::Server::Context)
           <a href="/redirect?referer=#{env.get("current_page")}">#{switch_instance}</a>
         </li>
         <li>
-          <a href="https://youtube.com#{env.request.resource}">#{go_to_youtube}</a>
+          <a rel="noreferrer noopener" href="https://youtube.com#{env.request.resource}">#{go_to_youtube}</a>
         </li>
       </ul>
     END_HTML
diff --git a/src/invidious/views/components/video-context-buttons.ecr b/src/invidious/views/components/video-context-buttons.ecr
index 385ed6b3..22458a03 100644
--- a/src/invidious/views/components/video-context-buttons.ecr
+++ b/src/invidious/views/components/video-context-buttons.ecr
@@ -1,6 +1,6 @@
 <div class="flex-right flexible">
     <div class="icon-buttons">
-        <a title="<%=translate(locale, "videoinfo_watch_on_youTube")%>" href="https://www.youtube.com/watch<%=endpoint_params%>">
+        <a title="<%=translate(locale, "videoinfo_watch_on_youTube")%>" rel="noreferrer noopener" href="https://www.youtube.com/watch<%=endpoint_params%>">
             <i class="icon ion-logo-youtube"></i>
         </a>
         <a title="<%=translate(locale, "Audio mode")%>" href="/watch<%=endpoint_params%>&listen=1">
diff --git a/src/invidious/views/playlist.ecr b/src/invidious/views/playlist.ecr
index 24ba437d..c27ddba6 100644
--- a/src/invidious/views/playlist.ecr
+++ b/src/invidious/views/playlist.ecr
@@ -83,7 +83,7 @@
 
         <% if !playlist.is_a? InvidiousPlaylist %>
             <div class="pure-u-2-3">
-                    <a href="https://www.youtube.com/playlist?list=<%= playlist.id %>">
+                    <a rel="noreferrer noopener" href="https://www.youtube.com/playlist?list=<%= playlist.id %>">
                         <%= translate(locale, "View playlist on YouTube") %>
                     </a>
                     <span> | </span>
diff --git a/src/invidious/views/watch.ecr b/src/invidious/views/watch.ecr
index 7a1cf2c3..586b4cff 100644
--- a/src/invidious/views/watch.ecr
+++ b/src/invidious/views/watch.ecr
@@ -26,7 +26,7 @@
 <meta name="twitter:player" content="<%= HOST_URL %>/embed/<%= video.id %>">
 <meta name="twitter:player:width" content="1280">
 <meta name="twitter:player:height" content="720">
-<link rel="alternate" href="https://www.youtube.com/watch?v=<%= video.id %>">
+<link rel="alternate noreferrer noopener" href="https://www.youtube.com/watch?v=<%= video.id %>">
 <%= rendered "components/player_sources" %>
 <title><%= title %> - Invidious</title>
 
@@ -123,8 +123,8 @@ we're going to need to do it here in order to allow for translations.
                         link_yt_embed = IV::HttpServer::Utils.add_params_to_url(link_yt_embed, link_yt_param)
                     end
                 -%>
-                <a id="link-yt-watch" data-base-url="<%= link_yt_watch %>" href="<%= link_yt_watch %>"><%= translate(locale, "videoinfo_watch_on_youTube") %></a>
-                (<a id="link-yt-embed" data-base-url="<%= link_yt_embed %>" href="<%= link_yt_embed %>"><%= translate(locale, "videoinfo_youTube_embed_link") %></a>)
+                <a id="link-yt-watch" rel="noreferrer noopener" data-base-url="<%= link_yt_watch %>" href="<%= link_yt_watch %>"><%= translate(locale, "videoinfo_watch_on_youTube") %></a>
+                (<a id="link-yt-embed" rel="noreferrer noopener" data-base-url="<%= link_yt_embed %>" href="<%= link_yt_embed %>"><%= translate(locale, "videoinfo_youTube_embed_link") %></a>)
             </span>
 
             <p id="watch-on-another-invidious-instance">

From c4fec89a9bac0228f6fac6ab2e8547132b57cc98 Mon Sep 17 00:00:00 2001
From: ulmemxpoc <123284914+ulmemxpoc@users.noreply.github.com>
Date: Fri, 10 May 2024 11:23:11 -0700
Subject: [PATCH 2/2] Apply suggestions from code review

---
 src/invidious/frontend/comments_youtube.cr | 2 +-
 src/invidious/views/watch.ecr              | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/invidious/frontend/comments_youtube.cr b/src/invidious/frontend/comments_youtube.cr
index f9eb44ef..a0e1d783 100644
--- a/src/invidious/frontend/comments_youtube.cr
+++ b/src/invidious/frontend/comments_youtube.cr
@@ -149,7 +149,7 @@ module Invidious::Frontend::Comments
 
         if comments["videoId"]?
           html << <<-END_HTML
-            <a rel="noreferrer noopener" href="#{YT_URL.to_s}/watch?v=#{comments["videoId"]}&lc=#{child["commentId"]}" title="#{translate(locale, "YouTube comment permalink")}">[YT]</a>
+            <a rel="noreferrer noopener" href="https://www.youtube.com/watch?v=#{comments["videoId"]}&lc=#{child["commentId"]}" title="#{translate(locale, "YouTube comment permalink")}">[YT]</a>
             |
           END_HTML
         elsif comments["authorId"]?
diff --git a/src/invidious/views/watch.ecr b/src/invidious/views/watch.ecr
index 586b4cff..fd9e1592 100644
--- a/src/invidious/views/watch.ecr
+++ b/src/invidious/views/watch.ecr
@@ -26,7 +26,7 @@
 <meta name="twitter:player" content="<%= HOST_URL %>/embed/<%= video.id %>">
 <meta name="twitter:player:width" content="1280">
 <meta name="twitter:player:height" content="720">
-<link rel="alternate noreferrer noopener" href="https://www.youtube.com/watch?v=<%= video.id %>">
+<link rel="alternate" href="https://www.youtube.com/watch?v=<%= video.id %>">
 <%= rendered "components/player_sources" %>
 <title><%= title %> - Invidious</title>