Add "noopener" to autolinks' rel attribute

lib/auto_link_scrubber.rb

@@ -46,7 +46,7 @@ class AutoLinkScrubber < Loofah::Scrubber
 
       links.each do |link|
         nodes << doc.create_text_node(text[pos...link[:start]]) if link[:start] > pos
-        nodes << doc.create_element("a", link[:text], href: link[:href], rel: "noreferrer")
+        nodes << doc.create_element("a", link[:text], href: link[:href], rel: "noopener noreferrer")
         pos = link[:start] + link[:length]
       end
       nodes << doc.create_text_node(text[pos..]) if pos < text.length

test/helpers/html_helper_test.rb

@@ -3,60 +3,60 @@ require "test_helper"
 class HtmlHelperTest < ActionView::TestCase
   test "convert URLs into anchor tags" do
     assert_equal_html \
-      %(<p>Check this: <a href="https://example.com" rel="noreferrer">https://example.com</a></p>),
+      %(<p>Check this: <a href="https://example.com" rel="noopener noreferrer">https://example.com</a></p>),
       format_html("<p>Check this: https://example.com</p>")
     assert_equal_html \
-      %(<p>Check this: <a href="https://example.com/" rel="noreferrer">https://example.com/</a></p>),
+      %(<p>Check this: <a href="https://example.com/" rel="noopener noreferrer">https://example.com/</a></p>),
       format_html("<p>Check this: https://example.com/</p>")
   end
 
   test "don't include punctuation in URL autolinking" do
     assert_equal_html \
-      %(<p>Check this: <a href="https://example.com/" rel="noreferrer">https://example.com/</a>!</p>),
+      %(<p>Check this: <a href="https://example.com/" rel="noopener noreferrer">https://example.com/</a>!</p>),
       format_html("<p>Check this: https://example.com/!</p>")
     assert_equal_html \
-      %(<p>Check this: <a href="https://example.com/" rel="noreferrer">https://example.com/</a>.</p>),
+      %(<p>Check this: <a href="https://example.com/" rel="noopener noreferrer">https://example.com/</a>.</p>),
       format_html("<p>Check this: https://example.com/.</p>")
     assert_equal_html \
-      %(<p>Check this: <a href="https://example.com/" rel="noreferrer">https://example.com/</a>?</p>),
+      %(<p>Check this: <a href="https://example.com/" rel="noopener noreferrer">https://example.com/</a>?</p>),
       format_html("<p>Check this: https://example.com/?</p>")
     assert_equal_html \
-      %(<p>Check this: <a href="https://example.com/" rel="noreferrer">https://example.com/</a>,</p>),
+      %(<p>Check this: <a href="https://example.com/" rel="noopener noreferrer">https://example.com/</a>,</p>),
       format_html("<p>Check this: https://example.com/,</p>")
     assert_equal_html \
-      %(<p>Check this: <a href="https://example.com/" rel="noreferrer">https://example.com/</a>:</p>),
+      %(<p>Check this: <a href="https://example.com/" rel="noopener noreferrer">https://example.com/</a>:</p>),
       format_html("<p>Check this: https://example.com/:</p>")
     assert_equal_html \
-      %(<p>Check this: <a href="https://example.com/" rel="noreferrer">https://example.com/</a>;</p>),
+      %(<p>Check this: <a href="https://example.com/" rel="noopener noreferrer">https://example.com/</a>;</p>),
       format_html("<p>Check this: https://example.com/;</p>")
     assert_equal_html \
-      %(<p>Check this: <a href="https://example.com/" rel="noreferrer">https://example.com/</a>"</p>),
+      %(<p>Check this: <a href="https://example.com/" rel="noopener noreferrer">https://example.com/</a>"</p>),
       format_html("<p>Check this: https://example.com/\"</p>")
     assert_equal_html \
-      %(<p>Check this: <a href="https://example.com/" rel="noreferrer">https://example.com/</a>'</p>),
+      %(<p>Check this: <a href="https://example.com/" rel="noopener noreferrer">https://example.com/</a>'</p>),
       format_html("<p>Check this: https://example.com/'</p>")
 
     # trailing entities that decode to punctuation
     # use assert_equal and not assert_equal_html to make sure we're getting entities correct
     assert_equal \
-      %(<p>Check this: <a href="https://example.com/" rel="noreferrer">https://example.com/</a>&lt;</p>),
+      %(<p>Check this: <a href="https://example.com/" rel="noopener noreferrer">https://example.com/</a>&lt;</p>),
       format_html("<p>Check this: https://example.com/&lt;</p>")
     assert_equal \
-      %(<p>Check this: <a href="https://example.com/" rel="noreferrer">https://example.com/</a>&gt;</p>),
+      %(<p>Check this: <a href="https://example.com/" rel="noopener noreferrer">https://example.com/</a>&gt;</p>),
       format_html("<p>Check this: https://example.com/&gt;</p>")
     assert_equal \
-      %(<p>Check this: <a href="https://example.com/" rel="noreferrer">https://example.com/</a>"</p>),
+      %(<p>Check this: <a href="https://example.com/" rel="noopener noreferrer">https://example.com/</a>"</p>),
       format_html("<p>Check this: https://example.com/&quot;</p>")
 
     # multiple punctuation characters including entities
     assert_equal_html \
-      %(<p>Check this: <a href="https://example.com/" rel="noreferrer">https://example.com/</a>!?;</p>),
+      %(<p>Check this: <a href="https://example.com/" rel="noopener noreferrer">https://example.com/</a>!?;</p>),
       format_html("<p>Check this: https://example.com/!?;</p>")
     assert_equal_html \
-      %(&lt;img src="<a href="https://example.com/" rel="noreferrer">https://example.com/</a>"&gt;),
+      %(&lt;img src="<a href="https://example.com/" rel="noopener noreferrer">https://example.com/</a>"&gt;),
       format_html(%(&lt;img src=&quot;https://example.com/&quot;&gt;))
     assert_equal_html \
-      %(&lt;img src="<a href="https://example.com/" rel="noreferrer">https://example.com/</a>"!&gt;),
+      %(&lt;img src="<a href="https://example.com/" rel="noopener noreferrer">https://example.com/</a>"!&gt;),
       format_html(%(&lt;img src=&quot;https://example.com/&quot;!&gt;))
   end
 
@@ -72,11 +72,11 @@ class HtmlHelperTest < ActionView::TestCase
   test "handle URLs with query parameters" do
     # use assert_equal and not assert_equal_html to make sure we're getting entities correct
     assert_equal \
-      %(<p>Check this: <a href="https://example.com/a?b=c&amp;d=e" rel="noreferrer">https://example.com/a?b=c&amp;d=e</a></p>),
+      %(<p>Check this: <a href="https://example.com/a?b=c&amp;d=e" rel="noopener noreferrer">https://example.com/a?b=c&amp;d=e</a></p>),
       format_html("<p>Check this: https://example.com/a?b=c&amp;d=e</p>")
 
     assert_equal \
-      %(<p>Check this: <a href="https://example.com/a?b=c&amp;d=e" rel="noreferrer">https://example.com/a?b=c&amp;d=e</a></p>),
+      %(<p>Check this: <a href="https://example.com/a?b=c&amp;d=e" rel="noopener noreferrer">https://example.com/a?b=c&amp;d=e</a></p>),
       format_html("<p>Check this: https://example.com/a?b=c&d=e</p>")
   end
 
@@ -88,7 +88,7 @@ class HtmlHelperTest < ActionView::TestCase
 
   test "convert email addresses into mailto links" do
     assert_equal_html \
-      %(<p>Contact us at <a href="mailto:support@example.com" rel="noreferrer">support@example.com</a></p>),
+      %(<p>Contact us at <a href="mailto:support@example.com" rel="noopener noreferrer">support@example.com</a></p>),
       format_html("<p>Contact us at support@example.com</p>")
   end