security: fix reverse tabnabbing vulnerability via target="_blank" (#23)

Added rel="noopener noreferrer" to all occurrences of target="_blank" in the codebase to prevent potential reverse tabnabbing attacks. Affected files include src/pages/user.tsx, src/pages/api-tokens.tsx, src/components/sider.tsx, src/components/main-layout.tsx, and others.

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Co-authored-by: sunnylqm <615282+sunnylqm@users.noreply.github.com>

Author: sunnylqm

src/components/main-layout.tsx

@@ -149,7 +149,7 @@ const ExtLink = ({ children, href }: ExtLinkProps) => (
     href={href}
     target="_blank"
     // onClick={(e) => e.stopPropagation()}
-    rel="noreferrer"
+    rel="noopener noreferrer"
   >
     {children}
   </a>

src/components/sider.tsx

@@ -210,7 +210,7 @@ const SiderMenu = ({ selectedKeys, onNavigate }: SiderMenuProps) => {
             7日平均剩余次数：{user.last7dAvg?.toLocaleString()} 次
           </div>
           <div className="text-xs mt-2 text-center">
-            <a target="_blank" href={PRICING_LINK} rel="noreferrer">
+            <a target="_blank" href={PRICING_LINK} rel="noopener noreferrer">
               {quota?.title}
             </a>
             可用: {pvQuota?.toLocaleString()} 次/每日

src/pages/api-tokens.tsx

@@ -189,7 +189,7 @@ function ApiTokensPage() {
               <a
                 target="_blank"
                 href="https://update.reactnative.cn/api/openapi"
-                rel="noopener"
+                rel="noopener noreferrer"
               >
                 Pushy API
               </a>

src/pages/manage/components/commit.tsx

@@ -56,7 +56,7 @@ export const Commit = ({ commit }: { commit?: Commit }) => {
                 className="text-xs"
                 href={url}
                 target="_blank"
-                rel="noreferrer"
+                rel="noopener noreferrer"
               >
                 {hash}
               </a>

src/pages/manage/components/version-table.tsx

@@ -53,7 +53,7 @@ const TestQrCode = ({ name, hash }: { name?: string; hash: string }) => {
               target="_blank"
               className="ml-1 text-xs"
               href={TEST_QR_CODE_DOC}
-              rel="noreferrer"
+              rel="noopener noreferrer"
             >
               如何使用？
             </a>

src/pages/register.tsx

@@ -116,7 +116,7 @@ export const Register = () => {
                   <a
                     target="_blank"
                     href="https://pushy.reactnative.cn/agreement/"
-                    rel="noreferrer"
+                    rel="noopener noreferrer"
                   >
                     用户协议
                   </a>

src/pages/user.tsx

@@ -252,6 +252,7 @@ function UserPanel() {
         <Button
           href={PRICING_LINK}
           target="_blank"
+          rel="noopener noreferrer"
           className="w-full md:w-auto"
         >
           查看价格表
@@ -261,6 +262,7 @@ function UserPanel() {
           className="w-full md:w-auto"
           href="https://pushy.reactnative.cn/docs/faq.html#%E5%8F%AF%E4%BB%A5%E4%BD%BF%E7%94%A8%E9%93%B6%E8%A1%8C%E8%BD%AC%E8%B4%A6%E4%BB%98%E6%AC%BE%E5%90%97"
           target="_blank"
+          rel="noopener noreferrer"
         >
           使用网银转账
         </Button>