Low: Fix self-XSS in SVGs

2026-10-13 07:15:19 +00:00 · 2026-05-17 09:57:41 -04:00
parent 160c916ce0
commit 29113402ce
5 changed files with 22 additions and 15 deletions
@@ -31,18 +31,24 @@ const AttachmentIcon = (props) => {
    imageFile = fileDocument;
    imageLabel = t("notifications_attachment_file_document");
  }
+  const icon = (
+    <Box
+      component="img"
+      src={imageFile}
+      alt={imageLabel}
+      loading="lazy"
+      sx={{
+        width: "28px",
+        height: "28px",
+      }}
+    />
+  );
+  if (!props.href) {
+    return icon;
+  }
  return (
-    <Link href={props.href} target="_blank">
-      <Box
-        component="img"
-        src={imageFile}
-        alt={imageLabel}
-        loading="lazy"
-        sx={{
-          width: "28px",
-          height: "28px",
-        }}
-      />
+    <Link href={props.href} target="_blank" rel="noopener noreferrer">
+      {icon}
    </Link>
  );
 };