Fix tab nabbing vulnerability in formatted links

- Add attribute rel="noopener noreferrer" to <a> tags created by formats/link.js - Make unit tests for links expect rel attribute
slab · Sep 9, 2019 · ec5e3ce · ec5e3ce
1 parent cc8526d
commit ec5e3ce
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 5 deletions.
diff --git a/formats/link.js b/formats/link.js
@@ -6,6 +6,7 @@ class Link extends Inline {
     let node = super.create(value);
     value = this.sanitize(value);
     node.setAttribute('href', value);
+    node.setAttribute('rel', 'noopener noreferrer');
     node.setAttribute('target', '_blank');
     return node;
   }

diff --git a/test/unit/formats/link.js b/test/unit/formats/link.js
@@ -12,7 +12,7 @@ describe('Link', function() {
       .insert('12', { link: 'https://quilljs.com' })
       .insert('3\n')
     );
-    expect(editor.scroll.domNode).toEqualHTML('<p>0<a href="https://quilljs.com" target="_blank">12</a>3</p>');
+    expect(editor.scroll.domNode).toEqualHTML('<p>0<a href="https://quilljs.com" target="_blank" rel="noopener noreferrer">12</a>3</p>');
   });
 
   it('add invalid', function() {
@@ -33,22 +33,22 @@ describe('Link', function() {
       .insert('12', { link: Link.SANITIZED_URL })
       .insert('3\n')
     );
-    expect(editor.scroll.domNode).toEqualHTML('<p>0<a href="about:blank" target="_blank">12</a>3</p>');
+    expect(editor.scroll.domNode).toEqualHTML('<p>0<a href="about:blank" target="_blank" rel="noopener noreferrer">12</a>3</p>');
   });
 
   it('change', function() {
-    let editor = this.initialize(Editor, '<p>0<a href="https://github.com" target="_blank">12</a>3</p>');
+    let editor = this.initialize(Editor, '<p>0<a href="https://github.com" target="_blank" rel="noopener noreferrer">12</a>3</p>');
     editor.formatText(1, 2, { link:  'https://quilljs.com' });
     expect(editor.getDelta()).toEqual(new Delta()
       .insert('0')
       .insert('12', { link: 'https://quilljs.com' })
       .insert('3\n')
     );
-    expect(editor.scroll.domNode).toEqualHTML('<p>0<a href="https://quilljs.com" target="_blank">12</a>3</p>');
+    expect(editor.scroll.domNode).toEqualHTML('<p>0<a href="https://quilljs.com" target="_blank" rel="noopener noreferrer">12</a>3</p>');
   });
 
   it('remove', function() {
-    let editor = this.initialize(Editor, '<p>0<a class="ql-size-large" href="https://quilljs.com" target="_blank">12</a>3</p>');
+    let editor = this.initialize(Editor, '<p>0<a class="ql-size-large" href="https://quilljs.com" target="_blank" rel="noopener noreferrer">12</a>3</p>');
     editor.formatText(1, 2, { link: false });
     let delta = new Delta().insert('0').insert('12', { size: 'large' }).insert('3\n');
     expect(editor.getDelta()).toEqual(delta);