Merge pull request #1355 from tgfjt/feature/tabnabbing

add noopener & noreferrer into targetBlank
yabwe · Jul 27, 2017 · c619e75 · c619e75
2 parents 4ba4fff + ac5a6cb
commit c619e75
Show file tree

Hide file tree

Showing 3 changed files with 17 additions and 0 deletions.
diff --git a/dist/js/medium-editor.js b/dist/js/medium-editor.js
@@ -544,6 +544,9 @@ MediumEditor.extensions = {};
             Util.moveTextRangeIntoElement(textNodes[0], textNodes[textNodes.length - 1], anchor);
             anchor.setAttribute('href', href);
             if (target) {
+                if (target === '_blank') {
+                    anchor.setAttribute('rel', 'noopener noreferrer');
+                }
                 anchor.setAttribute('target', target);
             }
             return anchor;
@@ -989,12 +992,14 @@ MediumEditor.extensions = {};
             var i, url = anchorUrl || false;
             if (el.nodeName.toLowerCase() === 'a') {
                 el.target = '_blank';
+                el.rel = 'noopener noreferrer';
             } else {
                 el = el.getElementsByTagName('a');
 
                 for (i = 0; i < el.length; i += 1) {
                     if (false === url || url === el[i].attributes.href.value) {
                         el[i].target = '_blank';
+                        el[i].rel = 'noopener noreferrer';
                     }
                 }
             }
@@ -1008,12 +1013,14 @@ MediumEditor.extensions = {};
             var i;
             if (el.nodeName.toLowerCase() === 'a') {
                 el.removeAttribute('target');
+                el.removeAttribute('rel');
             } else {
                 el = el.getElementsByTagName('a');
 
                 for (i = 0; i < el.length; i += 1) {
                     if (anchorUrl === el[i].attributes.href.value) {
                         el[i].removeAttribute('target');
+                        el[i].removeAttribute('rel');
                     }
                 }
             }

diff --git a/spec/anchor.spec.js b/spec/anchor.spec.js
@@ -592,6 +592,7 @@ describe('Anchor Button TestCase', function () {
             link = editor.elements[0].querySelector('a');
             expect(link).not.toBeNull();
             expect(link.target).toBe('_blank');
+            expect(link.rel).toBe('noopener noreferrer');
         });
 
         it('should add target="_blank" when respective option is set to true', function () {
@@ -608,6 +609,7 @@ describe('Anchor Button TestCase', function () {
             link = editor.elements[0].querySelector('a');
             expect(link).not.toBeNull();
             expect(link.target).toBe('_blank');
+            expect(link.rel).toBe('noopener noreferrer');
         });
 
         it('should create a button when user selects this option and presses enter', function () {
@@ -717,6 +719,7 @@ describe('Anchor Button TestCase', function () {
             fireEvent(anchorExtension.getForm().querySelector('a.medium-editor-toolbar-save'), 'click');
             link = editor.elements[0].querySelector('a');
             expect(link.target).toBe('_blank');
+            expect(link.rel).toBe('noopener noreferrer');
 
             selectElementContentsAndFire(editor.elements[0]);
             anchorExtension.showForm('http://test.com');

diff --git a/src/js/util.js b/src/js/util.js
@@ -138,6 +138,9 @@
             Util.moveTextRangeIntoElement(textNodes[0], textNodes[textNodes.length - 1], anchor);
             anchor.setAttribute('href', href);
             if (target) {
+                if (target === '_blank') {
+                    anchor.setAttribute('rel', 'noopener noreferrer');
+                }
                 anchor.setAttribute('target', target);
             }
             return anchor;
@@ -583,12 +586,14 @@
             var i, url = anchorUrl || false;
             if (el.nodeName.toLowerCase() === 'a') {
                 el.target = '_blank';
+                el.rel = 'noopener noreferrer';
             } else {
                 el = el.getElementsByTagName('a');
 
                 for (i = 0; i < el.length; i += 1) {
                     if (false === url || url === el[i].attributes.href.value) {
                         el[i].target = '_blank';
+                        el[i].rel = 'noopener noreferrer';
                     }
                 }
             }
@@ -602,12 +607,14 @@
             var i;
             if (el.nodeName.toLowerCase() === 'a') {
                 el.removeAttribute('target');
+                el.removeAttribute('rel');
             } else {
                 el = el.getElementsByTagName('a');
 
                 for (i = 0; i < el.length; i += 1) {
                     if (anchorUrl === el[i].attributes.href.value) {
                         el[i].removeAttribute('target');
+                        el[i].removeAttribute('rel');
                     }
                 }
             }