From 0f05e9a88de8defbb6046d05a1a87b887670d0a5 Mon Sep 17 00:00:00 2001
From: Jens Kraemer <jk@jkraemer.net>
Date: Wed, 1 Jun 2022 15:44:09 +0800
Subject: [PATCH] add rel="noopener" to all external links with a target
 attribute #685568 #796046

---
 .../wiki_formatting/common_mark/external_links_filter.rb    | 6 ++++++
 .../common_mark/external_links_filter_test.rb               | 5 +++++
 2 files changed, 11 insertions(+)

diff --git a/lib/redmine/wiki_formatting/common_mark/external_links_filter.rb b/lib/redmine/wiki_formatting/common_mark/external_links_filter.rb
index 2aab08aa12..68ece55bb0 100644
--- a/lib/redmine/wiki_formatting/common_mark/external_links_filter.rb
+++ b/lib/redmine/wiki_formatting/common_mark/external_links_filter.rb
@@ -43,6 +43,12 @@ module Redmine
               klass,
               (scheme == "mailto" ? "email" : "external")
             ].compact.join " "
+
+            if node["target"].present? && scheme != "mailto"
+              rel = node["rel"]&.split || []
+              rel << "noopener"
+              node["rel"] = rel.join(" ")
+            end
           end
           doc
         end
diff --git a/test/unit/lib/redmine/wiki_formatting/common_mark/external_links_filter_test.rb b/test/unit/lib/redmine/wiki_formatting/common_mark/external_links_filter_test.rb
index d4b76c401c..f46f69c2ed 100644
--- a/test/unit/lib/redmine/wiki_formatting/common_mark/external_links_filter_test.rb
+++ b/test/unit/lib/redmine/wiki_formatting/common_mark/external_links_filter_test.rb
@@ -50,5 +50,10 @@ if Object.const_defined?(:CommonMarker)
         filter(%(<a href="http://example.com/foo#bar#">Malformed URI</a>))
       end
     end
+
+    def test_external_links_with_target_get_rel_noopener
+      assert_equal %(<a target="_blank" href="http://example.net/" class="external" rel="noopener">link</a>), filter(%(<a target="_blank" href="http://example.net/">link</a>))
+      assert_equal %(<a target="_blank" href="http://example.net/" rel="nofollow noopener" class="external">link</a>), filter(%(<a target="_blank" href="http://example.net/" rel="nofollow">link</a>))
+    end
   end
 end
-- 
2.30.2