Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Link: Allow explicit rel="opener" #1428

Closed
wants to merge 2 commits into from
Closed
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
@@ -1,6 +1,6 @@
// Jest Snapshot v1, https://goo.gl/fbAQLP

exports[`modules/createDOMProps includes "rel" values for "a" elements (to securely open external links) 1`] = `" noopener noreferrer"`;
exports[`modules/createDOMProps includes "rel" values for "a" elements (to securely open external links) 1`] = `"noopener noreferrer"`;

exports[`modules/createDOMProps includes base reset style for browser-styled elements 1`] = `"css-reset-4rbku5"`;

Expand Down
Expand Up @@ -193,6 +193,16 @@ describe('modules/createDOMProps', () => {
expect(props.rel).toMatchSnapshot();
});

test('allow explicit rel="opener" for "a" elements', () => {
const props = createDOMProps('a', { target: '_blank', rel: 'opener' });
expect(props.rel).toEqual('opener');
});

test('don\'t duplicate "rel" values for "a" elements', () => {
const props = createDOMProps('a', { target: '_blank', rel: 'noopener' });
expect(props.rel).toEqual('noopener noreferrer');
});

test('includes cursor style for pressable roles', () => {
expect(createDOMProps('span', { accessibilityRole: 'link' }).className).toMatchSnapshot();
expect(createDOMProps('span', { accessibilityRole: 'button' }).className).toMatchSnapshot();
Expand Down
8 changes: 6 additions & 2 deletions packages/react-native-web/src/modules/createDOMProps/index.js
Expand Up @@ -187,8 +187,12 @@ const createDOMProps = (component, props, styleResolver) => {
// https://mathiasbynens.github.io/rel-noopener/
// Note: using "noreferrer" doesn't impact referrer tracking for https
// transfers (i.e., from https to https).
if (component === 'a' && domProps.target === '_blank') {
domProps.rel = `${domProps.rel || ''} noopener noreferrer`;
// Note: Specifying rel="opener" will explicitly bypass this safeguard.
if (component === 'a' && domProps.target === '_blank' && domProps.rel !== 'opener') {
const existingRel = domProps.rel ? domProps.rel.split(' ') : [];
// Ensure that we don't end up with duplicates.
const newRel = new Set([...existingRel, 'noopener', 'noreferrer']);
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Creating a Set, array, then flattening it is unnecessary overhead on a hot path

Copy link
Author

@sstur sstur Sep 10, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Right. My original thinking was that this is the simplest way to prevent duplicates which I saw in the DOM. I don't know that it's a bug necessarily to have duplicates but I'm not sure that it's well defined in the spec what should happen if multiple conflicting or duplicates are in the rel attribute. I'll revert this change for a more performant one.

domProps.rel = Array.from(newRel).join(' ');
}
// Automated test IDs
if (testID && testID.constructor === String) {
Expand Down