From 301ac67b75088947873ff538f8ac85eff7f856c5 Mon Sep 17 00:00:00 2001
From: ben <ben@jammerware.com>
Date: Sun, 10 Mar 2019 17:10:00 -0400
Subject: [PATCH 1/2] Add rel="noreferrer" to links when openLinksInNewWindow
 is on.

---
 src/subParsers/makehtml/links.js                              | 2 +-
 .../features/#379.openLinksInNewWindow-breaks-em-markdup.html | 4 ++--
 .../cases/features/openLinksInNewWindow/simple-cases.html     | 4 ++--
 .../makehtml/cases/features/openLinksInNewWindow/simple.html  | 4 ++--
 .../features/openLinksInNewWindow/simplifiedAutoLink.html     | 2 +-
 5 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/src/subParsers/makehtml/links.js b/src/subParsers/makehtml/links.js
index 2c97baaa..9505df5a 100644
--- a/src/subParsers/makehtml/links.js
+++ b/src/subParsers/makehtml/links.js
@@ -117,7 +117,7 @@
     // to external links. Hash links (#) open in same page
     if (options.openLinksInNewWindow && !/^#/.test(url)) {
       // escaped _
-      target = ' target="¨E95Eblank"';
+      target = ' rel="noreferrer" target="¨E95Eblank"';
     }
 
     // Text can be a markdown element, so we run through the appropriate parsers
diff --git a/test/functional/makehtml/cases/features/#379.openLinksInNewWindow-breaks-em-markdup.html b/test/functional/makehtml/cases/features/#379.openLinksInNewWindow-breaks-em-markdup.html
index ab837e3c..4e29f8d1 100644
--- a/test/functional/makehtml/cases/features/#379.openLinksInNewWindow-breaks-em-markdup.html
+++ b/test/functional/makehtml/cases/features/#379.openLinksInNewWindow-breaks-em-markdup.html
@@ -1,2 +1,2 @@
-<p>My <a href="http://example.com" target="_blank">link</a> is <em>important</em></p>
-<p>My <a href="http://example.com" target="_blank">link</a> is <strong>important</strong></p>
+<p>My <a href="http://example.com" rel="noreferrer" target="_blank">link</a> is <em>important</em></p>
+<p>My <a href="http://example.com" rel="noreferrer" target="_blank">link</a> is <strong>important</strong></p>
diff --git a/test/functional/makehtml/cases/features/openLinksInNewWindow/simple-cases.html b/test/functional/makehtml/cases/features/openLinksInNewWindow/simple-cases.html
index c62a155c..b99dca96 100644
--- a/test/functional/makehtml/cases/features/openLinksInNewWindow/simple-cases.html
+++ b/test/functional/makehtml/cases/features/openLinksInNewWindow/simple-cases.html
@@ -1,2 +1,2 @@
-<p><a href="www.google.com" target="_blank">foo</a></p>
-<p>a link <a href="http://www.google.com" target="_blank">http://www.google.com</a></p>
+<p><a href="www.google.com" rel="noreferrer" target="_blank">foo</a></p>
+<p>a link <a href="http://www.google.com" rel="noreferrer" target="_blank">http://www.google.com</a></p>
diff --git a/test/functional/makehtml/cases/features/openLinksInNewWindow/simple.html b/test/functional/makehtml/cases/features/openLinksInNewWindow/simple.html
index c62a155c..b99dca96 100644
--- a/test/functional/makehtml/cases/features/openLinksInNewWindow/simple.html
+++ b/test/functional/makehtml/cases/features/openLinksInNewWindow/simple.html
@@ -1,2 +1,2 @@
-<p><a href="www.google.com" target="_blank">foo</a></p>
-<p>a link <a href="http://www.google.com" target="_blank">http://www.google.com</a></p>
+<p><a href="www.google.com" rel="noreferrer" target="_blank">foo</a></p>
+<p>a link <a href="http://www.google.com" rel="noreferrer" target="_blank">http://www.google.com</a></p>
diff --git a/test/functional/makehtml/cases/features/openLinksInNewWindow/simplifiedAutoLink.html b/test/functional/makehtml/cases/features/openLinksInNewWindow/simplifiedAutoLink.html
index c23bf68e..51fb7004 100644
--- a/test/functional/makehtml/cases/features/openLinksInNewWindow/simplifiedAutoLink.html
+++ b/test/functional/makehtml/cases/features/openLinksInNewWindow/simplifiedAutoLink.html
@@ -1 +1 @@
-<p>this is <a href="http://www.google.com" target="_blank">http://www.google.com</a> autolink</p>
+<p>this is <a href="http://www.google.com" rel="noreferrer" target="_blank">http://www.google.com</a> autolink</p>

From b8f7323d463dbb59b583f52e936fa7d7bbe66254 Mon Sep 17 00:00:00 2001
From: ben <ben@jammerware.com>
Date: Sun, 10 Mar 2019 17:19:36 -0400
Subject: [PATCH 2/2] Also add noopener when openLinksInNewWindow is on.

---
 src/subParsers/makehtml/links.js                              | 2 +-
 .../features/#379.openLinksInNewWindow-breaks-em-markdup.html | 4 ++--
 .../cases/features/openLinksInNewWindow/simple-cases.html     | 4 ++--
 .../makehtml/cases/features/openLinksInNewWindow/simple.html  | 4 ++--
 .../features/openLinksInNewWindow/simplifiedAutoLink.html     | 2 +-
 5 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/src/subParsers/makehtml/links.js b/src/subParsers/makehtml/links.js
index 9505df5a..09886214 100644
--- a/src/subParsers/makehtml/links.js
+++ b/src/subParsers/makehtml/links.js
@@ -117,7 +117,7 @@
     // to external links. Hash links (#) open in same page
     if (options.openLinksInNewWindow && !/^#/.test(url)) {
       // escaped _
-      target = ' rel="noreferrer" target="¨E95Eblank"';
+      target = ' rel="noopener noreferrer" target="¨E95Eblank"';
     }
 
     // Text can be a markdown element, so we run through the appropriate parsers
diff --git a/test/functional/makehtml/cases/features/#379.openLinksInNewWindow-breaks-em-markdup.html b/test/functional/makehtml/cases/features/#379.openLinksInNewWindow-breaks-em-markdup.html
index 4e29f8d1..9d22dee8 100644
--- a/test/functional/makehtml/cases/features/#379.openLinksInNewWindow-breaks-em-markdup.html
+++ b/test/functional/makehtml/cases/features/#379.openLinksInNewWindow-breaks-em-markdup.html
@@ -1,2 +1,2 @@
-<p>My <a href="http://example.com" rel="noreferrer" target="_blank">link</a> is <em>important</em></p>
-<p>My <a href="http://example.com" rel="noreferrer" target="_blank">link</a> is <strong>important</strong></p>
+<p>My <a href="http://example.com" rel="noopener noreferrer" target="_blank">link</a> is <em>important</em></p>
+<p>My <a href="http://example.com" rel="noopener noreferrer" target="_blank">link</a> is <strong>important</strong></p>
diff --git a/test/functional/makehtml/cases/features/openLinksInNewWindow/simple-cases.html b/test/functional/makehtml/cases/features/openLinksInNewWindow/simple-cases.html
index b99dca96..f20e2af5 100644
--- a/test/functional/makehtml/cases/features/openLinksInNewWindow/simple-cases.html
+++ b/test/functional/makehtml/cases/features/openLinksInNewWindow/simple-cases.html
@@ -1,2 +1,2 @@
-<p><a href="www.google.com" rel="noreferrer" target="_blank">foo</a></p>
-<p>a link <a href="http://www.google.com" rel="noreferrer" target="_blank">http://www.google.com</a></p>
+<p><a href="www.google.com" rel="noopener noreferrer" target="_blank">foo</a></p>
+<p>a link <a href="http://www.google.com" rel="noopener noreferrer" target="_blank">http://www.google.com</a></p>
diff --git a/test/functional/makehtml/cases/features/openLinksInNewWindow/simple.html b/test/functional/makehtml/cases/features/openLinksInNewWindow/simple.html
index b99dca96..f20e2af5 100644
--- a/test/functional/makehtml/cases/features/openLinksInNewWindow/simple.html
+++ b/test/functional/makehtml/cases/features/openLinksInNewWindow/simple.html
@@ -1,2 +1,2 @@
-<p><a href="www.google.com" rel="noreferrer" target="_blank">foo</a></p>
-<p>a link <a href="http://www.google.com" rel="noreferrer" target="_blank">http://www.google.com</a></p>
+<p><a href="www.google.com" rel="noopener noreferrer" target="_blank">foo</a></p>
+<p>a link <a href="http://www.google.com" rel="noopener noreferrer" target="_blank">http://www.google.com</a></p>
diff --git a/test/functional/makehtml/cases/features/openLinksInNewWindow/simplifiedAutoLink.html b/test/functional/makehtml/cases/features/openLinksInNewWindow/simplifiedAutoLink.html
index 51fb7004..6dff350b 100644
--- a/test/functional/makehtml/cases/features/openLinksInNewWindow/simplifiedAutoLink.html
+++ b/test/functional/makehtml/cases/features/openLinksInNewWindow/simplifiedAutoLink.html
@@ -1 +1 @@
-<p>this is <a href="http://www.google.com" rel="noreferrer" target="_blank">http://www.google.com</a> autolink</p>
+<p>this is <a href="http://www.google.com" rel="noopener noreferrer" target="_blank">http://www.google.com</a> autolink</p>