From caab5bb7bc617c1721967bd1a12c633927f2aafb Mon Sep 17 00:00:00 2001
From: Jammerware <ben.s.stein@gmail.com>
Date: Sat, 2 Nov 2019 14:58:07 -0400
Subject: [PATCH] fix: Add rel="noopener noreferrer" to links when
 openLinksInNewWindow is on

Add rel="noreferrer" to links when openLinksInNewWindow is on. Also add noopener when openLinksInNewWindow is on.

Closes #670
---
 src/subParsers/makehtml/links.js                              | 2 +-
 .../features/#379.openLinksInNewWindow-breaks-em-markdup.html | 4 ++--
 .../cases/features/openLinksInNewWindow/simple-cases.html     | 4 ++--
 .../makehtml/cases/features/openLinksInNewWindow/simple.html  | 4 ++--
 .../features/openLinksInNewWindow/simplifiedAutoLink.html     | 2 +-
 5 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/src/subParsers/makehtml/links.js b/src/subParsers/makehtml/links.js
index 2c97baaa..09886214 100644
--- a/src/subParsers/makehtml/links.js
+++ b/src/subParsers/makehtml/links.js
@@ -117,7 +117,7 @@
     // to external links. Hash links (#) open in same page
     if (options.openLinksInNewWindow && !/^#/.test(url)) {
       // escaped _
-      target = ' target="¨E95Eblank"';
+      target = ' rel="noopener noreferrer" target="¨E95Eblank"';
     }
 
     // Text can be a markdown element, so we run through the appropriate parsers
diff --git a/test/functional/makehtml/cases/features/#379.openLinksInNewWindow-breaks-em-markdup.html b/test/functional/makehtml/cases/features/#379.openLinksInNewWindow-breaks-em-markdup.html
index ab837e3c..9d22dee8 100644
--- a/test/functional/makehtml/cases/features/#379.openLinksInNewWindow-breaks-em-markdup.html
+++ b/test/functional/makehtml/cases/features/#379.openLinksInNewWindow-breaks-em-markdup.html
@@ -1,2 +1,2 @@
-<p>My <a href="http://example.com" target="_blank">link</a> is <em>important</em></p>
-<p>My <a href="http://example.com" target="_blank">link</a> is <strong>important</strong></p>
+<p>My <a href="http://example.com" rel="noopener noreferrer" target="_blank">link</a> is <em>important</em></p>
+<p>My <a href="http://example.com" rel="noopener noreferrer" target="_blank">link</a> is <strong>important</strong></p>
diff --git a/test/functional/makehtml/cases/features/openLinksInNewWindow/simple-cases.html b/test/functional/makehtml/cases/features/openLinksInNewWindow/simple-cases.html
index c62a155c..f20e2af5 100644
--- a/test/functional/makehtml/cases/features/openLinksInNewWindow/simple-cases.html
+++ b/test/functional/makehtml/cases/features/openLinksInNewWindow/simple-cases.html
@@ -1,2 +1,2 @@
-<p><a href="www.google.com" target="_blank">foo</a></p>
-<p>a link <a href="http://www.google.com" target="_blank">http://www.google.com</a></p>
+<p><a href="www.google.com" rel="noopener noreferrer" target="_blank">foo</a></p>
+<p>a link <a href="http://www.google.com" rel="noopener noreferrer" target="_blank">http://www.google.com</a></p>
diff --git a/test/functional/makehtml/cases/features/openLinksInNewWindow/simple.html b/test/functional/makehtml/cases/features/openLinksInNewWindow/simple.html
index c62a155c..f20e2af5 100644
--- a/test/functional/makehtml/cases/features/openLinksInNewWindow/simple.html
+++ b/test/functional/makehtml/cases/features/openLinksInNewWindow/simple.html
@@ -1,2 +1,2 @@
-<p><a href="www.google.com" target="_blank">foo</a></p>
-<p>a link <a href="http://www.google.com" target="_blank">http://www.google.com</a></p>
+<p><a href="www.google.com" rel="noopener noreferrer" target="_blank">foo</a></p>
+<p>a link <a href="http://www.google.com" rel="noopener noreferrer" target="_blank">http://www.google.com</a></p>
diff --git a/test/functional/makehtml/cases/features/openLinksInNewWindow/simplifiedAutoLink.html b/test/functional/makehtml/cases/features/openLinksInNewWindow/simplifiedAutoLink.html
index c23bf68e..6dff350b 100644
--- a/test/functional/makehtml/cases/features/openLinksInNewWindow/simplifiedAutoLink.html
+++ b/test/functional/makehtml/cases/features/openLinksInNewWindow/simplifiedAutoLink.html
@@ -1 +1 @@
-<p>this is <a href="http://www.google.com" target="_blank">http://www.google.com</a> autolink</p>
+<p>this is <a href="http://www.google.com" rel="noopener noreferrer" target="_blank">http://www.google.com</a> autolink</p>