Ticket #43187: 43187.1.diff

src/wp-includes/default-filters.php

@@ -475 +475 @@
 // Shortcodes
 add_filter( 'the_content', 'do_shortcode', 11 ); // AFTER wpautop()
 
+// Phishing prevention
+add_filter( 'the_content', 'wp_rel_nofollow_noopener', 12 );
+
 // Media
 add_action( 'wp_playlist_scripts', 'wp_playlist_scripts' );
 add_action( 'customize_controls_enqueue_scripts', 'wp_plupload_default_settings' );

src/wp-includes/formatting.php

@@ -2985 +2985 @@
 }
 
 /**
+ * Adds rel nofollow and noopener to all HTML A elements that have a target.
+ *
+ * @param string $text Content that may contain HTML A elements.
+ * @return string Converted content.
+ */
+function wp_rel_nofollow_noopener( $text ) {
+        $text = preg_replace_callback( '|<a (.+target\s*=.+?)>|i', 'wp_rel_nofollow_noopener_callback', $text );
+        return $text;
+}
+
+/**
+ * Callback to add rel="nofollow noopener" string to HTML A element.
+ *
+ * Will remove already existing nofollow and noopener from the
+ * string to prevent from invalidating (X)HTML.
+ *
+ * @param array $matches Single Match
+ * @return string HTML A Element with rel nofollow and noopener if the target is set
+ */
+function wp_rel_nofollow_noopener_callback( $matches ) {
+        $text = $matches[1];
+        $rel  = 'nofollow noopener';
+        $rel_match = array();
+
+        // value with delimiters, spaces around = optional
+        $attr_regex  = '|rel\s*=\s*?(["\'])(.*?)\\1|i';
+        preg_match( $attr_regex, $text, $rel_match );
+
+        if ( empty( $rel_match[0] ) ) {
+                // no delimters, try with a single value and spaces, because `rel =  va"lue` is totally fine...
+                $attr_regex  = '|rel\s*=(\s*)([^\s]*)|i';
+                preg_match( $attr_regex, $text, $rel_match );
+        }
+
+        if ( ! empty( $rel_match[0] ) ) {
+                $parts = preg_split( '|\s+|', strtolower( $rel_match[2] ) );
+                $parts = array_map( 'esc_attr', $parts );
+                if ( false === in_array( 'nofollow', $parts ) ) {
+                        $parts[] = 'nofollow';
+                }
+                if ( false === in_array( 'noopener', $parts ) ) {
+                        $parts[] = 'noopener';
+                }
+                $rel = 'rel="' . trim( implode( ' ', $parts ) ) . '"';
+
+                $text = str_replace( $rel_match[0], $rel, $text );
+        } else {
+                $text .= " rel=\"$rel\"";
+        }
+        return "<a $text>";
+}
+
+/**
  * Callback to add rel=nofollow string to HTML A element.
  *
  * Will remove already existing rel="nofollow" and rel='nofollow' from the

tests/phpunit/tests/formatting/WPRelNoFollowNoOpener.php

@@ +1 @@
+<?php
+
+/**
+ * @group formatting
+ */
+class Tests_Rel_No_Follow_No_Opener extends WP_UnitTestCase {
+
+        public function test_add_no_follow_no_opener_to_links_with_target() {
+                $content  = '<p>Links: <a href="/" target="_blank">No rel</a></p>';
+                $expected = '<p>Links: <a href="/" target="_blank" rel="nofollow noopener">No rel</a></p>';
+                $this->assertEquals( $expected, wp_rel_nofollow_noopener( $content ) );
+        }
+
+        public function test_add_no_follow_no_opener_to_existing_rel() {
+                $content  = '<p>Links: <a href="/" rel="existing values" target="_blank">Existing rel</a></p>';
+                $expected = '<p>Links: <a href="/" rel="existing values nofollow noopener" target="_blank">Existing rel</a></p>';
+                $this->assertEquals( $expected, wp_rel_nofollow_noopener( $content ) );
+        }
+
+        public function test_no_duplicate_values_added() {
+                $content  = '<p>Links: <a href="/" rel="existing noopener values" target="_blank">Existing rel</a></p>';
+                $expected = '<p>Links: <a href="/" rel="existing noopener values nofollow" target="_blank">Existing rel</a></p>';
+                $this->assertEquals( $expected, wp_rel_nofollow_noopener( $content ) );
+        }
+
+        public function test_rel_with_single_quote_delimiter() {
+                $content  = '<p>Links: <a href="/" rel=\'existing values\' target="_blank">Existing rel</a></p>';
+                $expected = '<p>Links: <a href="/" rel="existing values nofollow noopener" target="_blank">Existing rel</a></p>';
+                $this->assertEquals( $expected, wp_rel_nofollow_noopener( $content ) );
+        }
+
+        public function test_rel_with_no_delimiter() {
+                $content  = '<p>Links: <a href="/" rel=existing target="_blank">Existing rel</a></p>';
+                $expected = '<p>Links: <a href="/" rel="existing nofollow noopener" target="_blank">Existing rel</a></p>';
+                $this->assertEquals( $expected, wp_rel_nofollow_noopener( $content ) );
+        }
+
+        public function test_rel_value_spaced_and_no_delimiter() {
+                $content  = '<p>Links: <a href="/" rel = existing target="_blank">Existing rel</a></p>';
+                $expected = '<p>Links: <a href="/" rel="existing nofollow noopener" target="_blank">Existing rel</a></p>';
+                $this->assertEquals( $expected, wp_rel_nofollow_noopener( $content ) );
+        }
+
+        public function test_rel_value_spaced_and_no_delimiter_and_values_to_escape() {
+                $content  = '<p>Links: <a href="/" rel = existing"value target="_blank">Existing rel</a></p>';
+                $expected = '<p>Links: <a href="/" rel="existing&quot;value nofollow noopener" target="_blank">Existing rel</a></p>';
+                $this->assertEquals( $expected, wp_rel_nofollow_noopener( $content ) );
+        }
+
+        public function test_ignore_links_with_no_target() {
+                $content  = '<p>Links: <a href="/" target="_blank">Change me</a> <a href="/">Do not change me</a></p>';
+                $expected = '<p>Links: <a href="/" target="_blank" rel="nofollow noopener">Change me</a> <a href="/">Do not change me</a></p>';
+                $this->assertEquals( $expected, wp_rel_nofollow_noopener( $content ) );
+        }
+
+}

tests/phpunit/tests/rest-api/rest-attachments-controller.php

@@ -1016 +1016 @@
                                         ),
                                         'description' => array(
                                                 'raw'      => '<a href="#" target="_blank">link</a>',
-                                                'rendered' => '<p><a href="#" target="_blank">link</a></p>',
+                                                'rendered' => '<p><a href="#" target="_blank" rel="nofollow noopener">link</a></p>',
                                         ),
                                         'caption'     => array(
                                                 'raw'      => '<a href="#" target="_blank">link</a>',

tests/phpunit/tests/rest-api/rest-posts-controller.php

@@ -3186 +3186 @@
                                         ),
                                         'content' => array(
                                                 'raw'      => '<a href="#" target="_blank">link</a>',
-                                                'rendered' => '<p><a href="#" target="_blank">link</a></p>',
+                                                'rendered' => '<p><a href="#" target="_blank" rel="nofollow noopener">link</a></p>',
                                         ),
                                         'excerpt' => array(
                                                 'raw'      => '<a href="#" target="_blank">link</a>',