fix #5655

packages/docmanager-extension/src/index.ts

@@ -473,7 +473,7 @@ function addCommands(
       }
 
       return docManager.services.contents.getDownloadUrl(path).then(url => {
-        window.open(url, '_blank');
+        window.open(url, '_blank', 'noopener');
       });
     },
     icon: args => (args['icon'] as string) || '',

packages/extensionmanager/src/widget.tsx

@@ -163,7 +163,7 @@ function ListEntry(props: ListEntry.IProperties): React.ReactElement<any> {
     >
       <div className="jp-extensionmanager-entry-title">
         <div className="jp-extensionmanager-entry-name">
-          <a href={entry.url} target="_blank">
+          <a href={entry.url} target="_blank" rel="noopener">
             {entry.name}
           </a>
         </div>

packages/help-extension/src/index.tsx

@@ -292,10 +292,20 @@ function activate(
         'https://github.com/jupyterlab/jupyterlab/graphs/contributors';
       let externalLinks = (
         <span className="jp-About-externalLinks">
-          <a href={contributorsURL} target="_blank" className="jp-Button-flat">
+          <a
+            href={contributorsURL}
+            target="_blank"
+            rel="noopener"
+            className="jp-Button-flat"
+          >
             CONTRIBUTOR LIST
           </a>
-          <a href={jupyterURL} target="_blank" className="jp-Button-flat">
+          <a
+            href={jupyterURL}
+            target="_blank"
+            rel="noopener"
+            className="jp-Button-flat"
+          >
             ABOUT PROJECT JUPYTER
           </a>
         </span>

packages/notebook-extension/src/index.ts

@@ -1035,7 +1035,7 @@ function addCommands(
           args['format'] as string,
           notebookPath
         ) + '?download=true';
-      const child = window.open('', '_blank');
+      const child = window.open('', '_blank', 'noopener');
       const { context } = current;
 
       if (context.model.dirty && !context.model.readOnly) {

packages/rendermime/src/renderers.ts

@@ -643,6 +643,7 @@ namespace Private {
         el.target = '_self';
       } else {
         el.target = '_blank';
+        el.rel = 'noopener';
       }
     }