Add rel="noopener" to external links

Fixes #4764
This commit is contained in:
Francis Lachapelle committed 2019-06-10 13:20:44 -04:00
1 parent 3129e149df
commit 0e918a446a
7 files changed
+8 -5

No files matched your search

@@ -521,6 +521,8 @@ _xmlCharsetForCharset (NSString *charset)
== NSNotFound
&& ![value hasPrefix: @"mailto:"]
&& ![value hasPrefix: @"#"]);
if (!skipAttribute)
[resultPart appendString: @" rel=\"noopener\""];
}
// Avoid: <div style="background:url('http://www.sogo.nu/fileadmin/sogo/logos/sogo.bts.png' ); width: 200px; height: 200px;" title="ssss">
else if ([name isEqualToString: @"style"])
@@ -171,7 +171,7 @@
<div class="pseudo-input-container" ng-repeat="url in editor.card.urls">
<label class="pseudo-input-label"><var:entity const:name="nbsp"/>{{url.type.capitalize() | loc}}</label>
<div class="pseudo-input-field">
<a href="#" target="_new" ng-href="{{url.value}}">{{url.value}}</a>
<a href="#" rel="noopener" target="_new" ng-href="{{url.value}}">{{url.value}}</a>
</div>
</div>
</div>
@@ -125,7 +125,7 @@
<!-- attach urls -->
<md-list-item ng-show="::(editor.component.attachUrls.length > 0)">
<md-icon>link</md-icon>
<p ng-repeat="url in ::editor.component.attachUrls"><a target="_new" ng-href="{{::url.value}}" ng-bind="::url.value"><!-- link --></a></p>
<p ng-repeat="url in ::editor.component.attachUrls"><a rel="noopener" target="_new" ng-href="{{::url.value}}" ng-bind="::url.value"><!-- link --></a></p>
</md-list-item>
<!-- comment -->
<md-list-item ng-show="::editor.component.comment">
@@ -98,7 +98,7 @@
<!-- attach urls -->
<md-list-item ng-repeat="url in ::editor.component.attachUrls">
<md-icon>link</md-icon>
<p><a ng-href="{{::url.value}}" target="_new" ng-bind="::url.value"><!-- link --></a></p>
<p><a ng-href="{{::url.value}}" rel="noopener" target="_new" ng-bind="::url.value"><!-- link --></a></p>
</md-list-item>
<!-- comment -->
<md-list-item ng-show="::editor.component.comment">
@@ -14,7 +14,7 @@
function txt2html(linkyFilter) {
return function(text) {
// Linky will first sanitize the text; linefeeds are therefore encoded.
return text ? String(linkyFilter(text, ' _blank')).replace(/&#10;/gm, '<br>') : undefined;
return text ? String(linkyFilter(text, ' _blank', { rel: 'noopener' })).replace(/&#10;/gm, '<br>') : undefined;
};
}