Skip to content

Commit

Permalink
fix(openLinksInNewWindow): add rel="noopener noreferrer" to links
Browse files Browse the repository at this point in the history
Add rel="noreferrer" to links when openLinksInNewWindow is on. Also add noopener when openLinksInNewWindow is on.
target="_blank" without also adding rel="noopener noreferrer" creates a vulnerability
(since the site you're linking to has access to the window.opener by default.
This  adds rel="noopener noreferrer" to links generated by the makeHtml converter when openLinksInNewWindow is true.

Closes #670
  • Loading branch information
jammerware authored and tivie committed Nov 2, 2019
1 parent 58208e5 commit 1cd281f
Show file tree
Hide file tree
Showing 10 changed files with 16 additions and 16 deletions.
6 changes: 3 additions & 3 deletions dist/showdown.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion dist/showdown.js.map

Large diffs are not rendered by default.

2 changes: 1 addition & 1 deletion dist/showdown.min.js

Large diffs are not rendered by default.

2 changes: 1 addition & 1 deletion dist/showdown.min.js.map

Large diffs are not rendered by default.

4 changes: 2 additions & 2 deletions src/subParsers/anchors.js
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@ showdown.subParser('anchors', function (text, options, globals) {
// to external links. Hash links (#) open in same page
if (options.openLinksInNewWindow && !/^#/.test(url)) {
// escaped _
result += ' target="¨E95Eblank"';
result += ' rel="noopener noreferrer" target="¨E95Eblank"';
}

result += '>' + linkText + '</a>';
Expand Down Expand Up @@ -87,7 +87,7 @@ showdown.subParser('anchors', function (text, options, globals) {
var lnk = options.ghMentionsLink.replace(/\{u}/g, username),
target = '';
if (options.openLinksInNewWindow) {
target = ' target="¨E95Eblank"';
target = ' rel="noopener noreferrer" target="¨E95Eblank"';
}
return st + '<a href="' + lnk + '"' + target + '>' + mentions + '</a>';
});
Expand Down
2 changes: 1 addition & 1 deletion src/subParsers/autoLinks.js
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ var simpleURLRegex = /([*~_]+|\b)(((https?|ftp|dict):\/\/|www\.)[^'">\s]+?\.[^'
append = trailingPunctuation;
}
if (options.openLinksInNewWindow) {
target = ' target="¨E95Eblank"';
target = ' rel="noopener noreferrer" target="¨E95Eblank"';
}
return lmc + '<a href="' + link + '"' + target + '>' + lnkTxt + '</a>' + append + tmc;
};
Expand Down
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
<p>My <a href="http://example.com" target="_blank">link</a> is <em>important</em></p>
<p>My <a href="http://example.com" target="_blank">link</a> is <strong>important</strong></p>
<p>My <a href="http://example.com" rel="noopener noreferrer" target="_blank">link</a> is <em>important</em></p>
<p>My <a href="http://example.com" rel="noopener noreferrer" target="_blank">link</a> is <strong>important</strong></p>
4 changes: 2 additions & 2 deletions test/features/openLinksInNewWindow/simple-cases.html
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
<p><a href="www.google.com" target="_blank">foo</a></p>
<p>a link <a href="http://www.google.com" target="_blank">http://www.google.com</a></p>
<p><a href="www.google.com" rel="noopener noreferrer" target="_blank">foo</a></p>
<p>a link <a href="http://www.google.com" rel="noopener noreferrer" target="_blank">http://www.google.com</a></p>
4 changes: 2 additions & 2 deletions test/features/openLinksInNewWindow/simple.html
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
<p><a href="www.google.com" target="_blank">foo</a></p>
<p>a link <a href="http://www.google.com" target="_blank">http://www.google.com</a></p>
<p><a href="www.google.com" rel="noopener noreferrer" target="_blank">foo</a></p>
<p>a link <a href="http://www.google.com" rel="noopener noreferrer" target="_blank">http://www.google.com</a></p>
2 changes: 1 addition & 1 deletion test/features/openLinksInNewWindow/simplifiedAutoLink.html
Original file line number Diff line number Diff line change
@@ -1 +1 @@
<p>this is <a href="http://www.google.com" target="_blank">http://www.google.com</a> autolink</p>
<p>this is <a href="http://www.google.com" rel="noopener noreferrer" target="_blank">http://www.google.com</a> autolink</p>

0 comments on commit 1cd281f

Please sign in to comment.