title: Use window.open but block use of window.opener
body: <p>A while back I ran across an <a href="https://dev.to/ben/the-targetblank-vulnerability-by-example" rel="noreferrer">interesting security hole</a></p>
  
  <pre><code>&lt;a href="http://someurl.here" target="_blank"&gt;Link&lt;/a&gt;
  </code></pre>
  
  <p>Looks innocuous enough, but there's a hole because, by default, the page that's being opened is allowing the opened page to call back into it via <code>window.opener</code>. There are some restrictions, being cross-domain, but there's still some mischief that can be done</p>
  
  <pre><code>window.opener.location = 'http://gotcha.badstuff';
  </code></pre>
  
  <p>Now, HTML has a workaround</p>
  
  <pre><code>&lt;a href="http://someurl.here" target="_blank" rel="noopener noreferrer"&gt;Link&lt;/a&gt;
  </code></pre>
  
  <p>That prevents the new window from having <code>window.opener</code> passed to it. That's fine and good for HTML, but what if you're using <code>window.open</code>?</p>
  
  <pre><code>&lt;button type="button" onclick="window.open('http://someurl.here', '_blank');"&gt;
      Click Me
  &lt;/button&gt;
  </code></pre>
  
  <p>How would you block the use of <code>window.opener</code> being passed here?</p>