# Window.opener protection  Bypass

Phabricator's rel=noopener protection on user links was bypassed with a backslash-prefixed URL, letting a child window reverse-tabnab the parent via window.opener.

- Payout: $300
- Severity: medium
- Program: Phabricator
- Credited: ranjit_p
- Disclosed: 2018-02-17
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/306414
- Library page: https://bugbountylibrary.com/r/h1%3A306414
- Tags: domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:php technique:parser-differential vuln:misconfiguration vuln:open-redirect

**Target:** Phabricator document/comment link rendering (markup anchor tags)
**Root cause:** The link sanitizer only added rel=noopener/noreferrer for URLs it recognized as external; a URL like `/\x.com/index.php` was treated as a relative/internal link (no rel attribute) but browsers parse the backslash as a slash and navigate to the external host.
**Steps:**
1. Create a new document at `http://domain/w/`
2. Insert markup `[[ /\jackluru02.000webhostapp.com/tabnabbing.html | click_me ]]`
3. Host tabnabbing.html containing `<script>window.opener.location.replace('http://example.com');</script>`
4. Save and share the document with a victim
5. Victim clicks the link; it opens in a new window without rel=noopener and rewrites the parent Phabricator tab's location
**How found:** Observed that Phabricator adds rel=noreferrer to external links to block window.opener access, then hypothesized the sanitizer's URL classification could be tricked with a backslash-prefixed path that browsers normalize to an external host.
**Exploitation:** Attacker shares a Phabricator document containing a crafted link; when the victim clicks it, the child page executes JS that redirects the original Phabricator tab to an attacker-controlled phishing page via window.opener.location.replace.
**Insight:** When a sanitizer decides whether to add rel=noopener based on URL parsing, test parser-differential inputs like backslashes, `//`, and encoded slashes that browsers normalize to external origins but server-side URL parsers treat as relative paths.