From 632c5e3629c2432371bb6339ad883208bff64ac2 Mon Sep 17 00:00:00 2001 From: Chocobozzz Date: Mon, 19 Mar 2018 18:30:28 +0100 Subject: More secure target blank links --- client/src/app/videos/shared/markdown.service.ts | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) (limited to 'client/src/app/videos/shared') diff --git a/client/src/app/videos/shared/markdown.service.ts b/client/src/app/videos/shared/markdown.service.ts index 9d73efa46..dd8ff20d8 100644 --- a/client/src/app/videos/shared/markdown.service.ts +++ b/client/src/app/videos/shared/markdown.service.ts @@ -52,18 +52,19 @@ export class MarkdownService { return self.renderToken(tokens, idx, options) } - markdownIt.renderer.rules.link_open = function (tokens, idx, options, env, self) { - // If you are sure other plugins can't add `target` - drop check below - const aIndex = tokens[idx].attrIndex('target') + markdownIt.renderer.rules.link_open = function (tokens, index, options, env, self) { + const token = tokens[index] - if (aIndex < 0) { - tokens[idx].attrPush(['target', '_blank']) // add new attribute - } else { - tokens[idx].attrs[aIndex][1] = '_blank' // replace value of existing attr - } + const targetIndex = token.attrIndex('target') + if (targetIndex < 0) token.attrPush([ 'target', '_blank' ]) + else token.attrs[targetIndex][1] = '_blank' + + const relIndex = token.attrIndex('rel') + if (relIndex < 0) token.attrPush([ 'rel', 'noopener noreferrer' ]) + else token.attrs[relIndex][1] = 'noopener noreferrer' // pass token to default renderer. - return defaultRender(tokens, idx, options, env, self) + return defaultRender(tokens, index, options, env, self) } } -- cgit v1.2.3