fix(create-vite): add rel="noreferrer" to links with target="_blank"

[ArnaudBarre]

Same as #10675 but for other templates

[stackblitz]

Run & review this pull request in StackBlitz Codeflow.

[bluwy]

I don't think we need this for all templates? It's specifically added for Svelte as older browsers had the referrer/opener risk, but Vite being a framework that supports browsers that doesn't have this risk anymore, I think we can omit it.

[ArnaudBarre]

Oh I didn't know this was fixed, I'll check the versions on if this is long enough for all browsers I will close this

[ArnaudBarre]

So yeah the change landed Chrome 88, Firefox 79 and Safari end of 2018, which is almost the default target of Vite. Lean something. Let's close this

[Primajin]

Hmm I was about to propose the exact same change, since when you initially set up vite and run lint it will already error on an out of the box project.

mypath\src\App.jsx
  12:9  error  Using target="_blank" without rel="noreferrer" (which implies rel="noopener") is a security risk in older browsers: see https://mathiasbynens.github.io/rel-noopener/#recommendations  react/jsx-no-target-blank
  15:9  error  Using target="_blank" without rel="noreferrer" (which implies rel="noopener") is a security risk in older browsers: see https://mathiasbynens.github.io/rel-noopener/#recommendations  react/jsx-no-target-blank

✖ 2 problems (2 errors, 0 warnings)
  2 errors and 0 warnings potentially fixable with the `--fix` option.

I think a project of this magnitude should be clean out of the box with no (lint) errors 🙏🏻

[ArnaudBarre]

@Primajin Thanks for pointing it out (I never use the JS template 🙈), I've addressed it the linked PR

[rodrigc]

@ArnaudBarre What do you think about this: #16612 (comment)