Add rel="noopener" to all external links with a target attribute (#37713).

Patch by Jens Krämer.


git-svn-id: https://svn.redmine.org/redmine/trunk@21849 e93f8b46-1217-0410-a6f0-8f06a7374b81

lib/redmine/wiki_formatting/common_mark/external_links_filter.rb

@@ -43,6 +43,12 @@ module Redmine
               klass,
               (scheme == "mailto" ? "email" : "external")
             ].compact.join " "
+
+            if node["target"].present? && scheme != "mailto"
+              rel = node["rel"]&.split || []
+              rel << "noopener"
+              node["rel"] = rel.join(" ")
+            end
           end
           doc
         end

test/unit/lib/redmine/wiki_formatting/common_mark/external_links_filter_test.rb

@@ -50,5 +50,10 @@ if Object.const_defined?(:CommonMarker)
         filter(%(<a href="http://example.com/foo#bar#">Malformed URI</a>))
       end
     end
+
+    def test_external_links_with_target_get_rel_noopener
+      assert_equal %(<a target="_blank" href="http://example.net/" class="external" rel="noopener">link</a>), filter(%(<a target="_blank" href="http://example.net/">link</a>))
+      assert_equal %(<a target="_blank" href="http://example.net/" rel="nofollow noopener" class="external">link</a>), filter(%(<a target="_blank" href="http://example.net/" rel="nofollow">link</a>))
+    end
   end
 end