From 05822d6f970faad8ce4de2a9a7ae072eb555ef42 Mon Sep 17 00:00:00 2001
From: Tomas <norkunas.tom@gmail.com>
Date: Tue, 14 Sep 2021 10:12:42 +0300
Subject: [PATCH] Add `rel` config option for links

---
 .../Basic/NodeVisitor/ANodeVisitor.php        |  4 ++
 tests/FullSanitizerTest.php                   | 41 ++++++++++---------
 2 files changed, 25 insertions(+), 20 deletions(-)

diff --git a/src/Extension/Basic/NodeVisitor/ANodeVisitor.php b/src/Extension/Basic/NodeVisitor/ANodeVisitor.php
index 244db59..d5b94f4 100644
--- a/src/Extension/Basic/NodeVisitor/ANodeVisitor.php
+++ b/src/Extension/Basic/NodeVisitor/ANodeVisitor.php
@@ -62,6 +62,7 @@ public function getDefaultConfiguration(): array
             'allowed_hosts' => null,
             'allow_mailto' => true,
             'force_https' => false,
+            'rel' => null,
         ];
     }
 
@@ -69,6 +70,9 @@ protected function createNode(\DOMNode $domNode, Cursor $cursor): NodeInterface
     {
         $node = new ANode($cursor->node);
         $node->setAttribute('href', $this->sanitizer->sanitize($this->getAttribute($domNode, 'href')));
+        if ($this->config['rel'] !== null) {
+            $node->setAttribute('rel', $this->config['rel']);
+        }
 
         return $node;
     }
diff --git a/tests/FullSanitizerTest.php b/tests/FullSanitizerTest.php
index 99b52eb..66b1917 100644
--- a/tests/FullSanitizerTest.php
+++ b/tests/FullSanitizerTest.php
@@ -29,6 +29,7 @@ public function createSanitizer(): SanitizerInterface
                     'allowed_hosts' => ['trusted.com', 'external.com'],
                     'allow_mailto' => true,
                     'force_https' => false,
+                    'rel' => 'noopener',
                 ],
                 'blockquote' => [
                     'allowed_attributes' => ['data-attr'],
@@ -196,19 +197,19 @@ public function provideFixtures(): array
             ],
             [
                 '<a href="https://trusted.com" title="Link title" class="foo" data-attr="foo">Lorem ipsum</a>',
-                '<a href="https://trusted.com" title="Link title" data-attr="foo">Lorem ipsum</a>',
+                '<a href="https://trusted.com" rel="noopener" title="Link title" data-attr="foo">Lorem ipsum</a>',
             ],
             [
                 '<a href="https://untrusted.com" title="Link title" class="foo" data-attr="foo">Lorem ipsum</a>',
-                '<a title="Link title" data-attr="foo">Lorem ipsum</a>',
+                '<a rel="noopener" title="Link title" data-attr="foo">Lorem ipsum</a>',
             ],
             [
                 '<a href="https://external.com" title="Link title" class="foo" data-attr="foo">Lorem ipsum</a>',
-                '<a href="https://external.com" title="Link title" data-attr="foo">Lorem ipsum</a>',
+                '<a href="https://external.com" rel="noopener" title="Link title" data-attr="foo">Lorem ipsum</a>',
             ],
             [
                 '<a href="mailto:test&#64;gmail.com" title="Link title" class="foo" data-attr="foo">Lorem ipsum</a>',
-                '<a href="mailto:test&#64;gmail.com" title="Link title" data-attr="foo">Lorem ipsum</a>',
+                '<a href="mailto:test&#64;gmail.com" rel="noopener" title="Link title" data-attr="foo">Lorem ipsum</a>',
             ],
             [
                 '<blockquote class="foo" data-attr="foo">Lorem ipsum</blockquote>',
@@ -445,47 +446,47 @@ public function provideFixtures(): array
 
             [
                 '<a href="mailto:test&#64;gmail.com">Test</a>',
-                '<a href="mailto:test&#64;gmail.com">Test</a>',
+                '<a href="mailto:test&#64;gmail.com" rel="noopener">Test</a>',
             ],
             [
                 '<a href="mailto:alert(\'ok\')">Test</a>',
-                '<a>Test</a>',
+                '<a rel="noopener">Test</a>',
             ],
             [
                 '<a href="javascript:alert(\'ok\')">Test</a>',
-                '<a>Test</a>',
+                '<a rel="noopener">Test</a>',
             ],
             [
                 '<a href="javascript://%0Aalert(document.cookie)">Test</a>',
-                '<a>Test</a>',
+                '<a rel="noopener">Test</a>',
             ],
             [
                 '<a href="http://untrusted.com" onclick="alert(\'ok\')">Test</a>',
-                '<a>Test</a>',
+                '<a rel="noopener">Test</a>',
             ],
             [
                 '<a href="https://trusted.com">Test</a>',
-                '<a href="https://trusted.com">Test</a>',
+                '<a href="https://trusted.com" rel="noopener">Test</a>',
             ],
             [
                 '<a>Lorem ipsum</a>',
-                '<a>Lorem ipsum</a>',
+                '<a rel="noopener">Lorem ipsum</a>',
             ],
             [
                 '<a href="&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;">Lorem ipsum</a>',
-                '<a>Lorem ipsum</a>',
+                '<a rel="noopener">Lorem ipsum</a>',
             ],
             [
                 '<a href="http://trusted.com/index.html#this:stuff">Lorem ipsum</a>',
-                '<a href="http://trusted.com/index.html#this:stuff">Lorem ipsum</a>',
+                '<a href="http://trusted.com/index.html#this:stuff" rel="noopener">Lorem ipsum</a>',
             ],
             [
                 '<a href="java\0&#14;\t\r\n script:alert(\\\'foo\\\')">Lorem ipsum</a>',
-                '<a>Lorem ipsum</a>',
+                '<a rel="noopener">Lorem ipsum</a>',
             ],
             [
                 '<a href= onmouseover="alert(\\\'XSS\\\');">Lorem ipsum</a>',
-                '<a>Lorem ipsum</a>',
+                '<a rel="noopener">Lorem ipsum</a>',
             ],
 
             // Inspired by https://twitter.com/brutelogic/status/1066333383276593152?s=19
@@ -497,7 +498,7 @@ public function provideFixtures(): array
             // Inspired by https://html5sec.org
             [
                 '<a href="javascript:&apos;<svg onload&equals;alert&lpar;1&rpar;&nvgt;&apos;">Lorem ipsum</a>',
-                '<a>Lorem ipsum</a>',
+                '<a rel="noopener">Lorem ipsum</a>',
             ],
 
             /*
@@ -514,7 +515,7 @@ public function provideFixtures(): array
             ],
             [
                 '<a href="javascript:alert(\'ok\')">Lorem ipsum dolor sit amet, consectetur adipisicing elit.</a>',
-                '<a>Lorem ipsum dolor sit amet, consectetur adipisicing elit.</a>',
+                '<a rel="noopener">Lorem ipsum dolor sit amet, consectetur adipisicing elit.</a>',
             ],
             [
                 '<img src= onmouseover="alert(\'XSS\');" />',
@@ -526,7 +527,7 @@ public function provideFixtures(): array
             ],
             [
                 '<<a href="javascript:evil"/>a href="javascript:evil"/>',
-                '<a>a href&#61;&#34;javascript:evil&#34;/&gt;</a>',
+                '<a rel="noopener">a href&#61;&#34;javascript:evil&#34;/&gt;</a>',
             ],
             [
                 '!<textarea>&lt;/textarea&gt;&lt;svg/onload=prompt`xs`&gt;</textarea>!',
@@ -546,7 +547,7 @@ public function provideFixtures(): array
             ],
             [
                 '<scr<a>ipt>alert(1)</script>',
-                '<a>ipt&gt;alert(1)</a>',
+                '<a rel="noopener">ipt&gt;alert(1)</a>',
             ],
 
             /*
@@ -563,7 +564,7 @@ public function provideFixtures(): array
             ],
             [
                 '<a style="font-size: 40px; color: red;">Lorem ipsum dolor sit amet, consectetur.</a>',
-                '<a>Lorem ipsum dolor sit amet, consectetur.</a>',
+                '<a rel="noopener">Lorem ipsum dolor sit amet, consectetur.</a>',
             ],
         ]);
     }