Ticket #43187: 43187.6.diff
| File 43187.6.diff, 9.1 KB (added by , 7 years ago) |
|---|
-
src/wp-includes/formatting.php
2985 2985 } 2986 2986 2987 2987 /** 2988 * Adds rel nofollow and noopener to all HTML A elements that have a target. 2989 * 2990 * @param string $text Content that may contain HTML A elements. 2991 * @return string Converted content. 2992 */ 2993 function wp_targeted_link_rel( $text ) { 2994 $text = preg_replace_callback( '|<a([^>]*target\s*=[^>]*)>|i', 'wp_targeted_link_rel_callback', $text ); 2995 return $text; 2996 } 2997 2998 /** 2999 * Callback to add rel="nofollow noopener" string to HTML A element. 3000 * 3001 * Will remove already existing nofollow and noopener from the 3002 * string to prevent from invalidating (X)HTML. 3003 * 3004 * @param array $matches Single Match 3005 * @return string HTML A Element with rel nofollow and noopener if the target is set 3006 */ 3007 function wp_targeted_link_rel_callback( $matches ) { 3008 $text = $matches[1]; 3009 $rel = apply_filters( 'wp_targeted_link_rel', 'nofollow noopener' ); 3010 $rel_match = array(); 3011 3012 // value with delimiters, spaces around = optional 3013 $attr_regex = '|rel\s*=\s*?(\\\\{0,1}["\'])(.*?)\\1|i'; 3014 preg_match( $attr_regex, $text, $rel_match ); 3015 3016 if ( empty( $rel_match[0] ) ) { 3017 // no delimters, try with a single value and spaces, because `rel = va"lue` is totally fine... 3018 $attr_regex = '|rel\s*=(\s*)([^\s]*)|i'; 3019 preg_match( $attr_regex, $text, $rel_match ); 3020 } 3021 3022 if ( ! empty( $rel_match[0] ) ) { 3023 $parts = preg_split( '|\s+|', strtolower( $rel_match[2] ) ); 3024 $parts = array_map( 'esc_attr', $parts ); 3025 if ( false === in_array( 'nofollow', $parts ) ) { 3026 $parts[] = 'nofollow'; 3027 } 3028 if ( false === in_array( 'noopener', $parts ) ) { 3029 $parts[] = 'noopener'; 3030 } 3031 $delimiter = trim( $rel_match[1] ) ? $rel_match[1] : '"'; 3032 $rel = 'rel=' . $delimiter . trim( implode( ' ', $parts ) ) . $delimiter; 3033 $text = str_replace( $rel_match[0], $rel, $text ); 3034 } else { 3035 $text .= " rel=\"$rel\""; 3036 } 3037 return "<a$text>"; 3038 } 3039 3040 /** 2988 3041 * Callback to add rel=nofollow string to HTML A element. 2989 3042 * 2990 3043 * Will remove already existing rel="nofollow" and rel='nofollow' from the -
src/wp-includes/kses.php
1887 1887 add_filter( 'content_filtered_save_pre', 'wp_filter_post_kses' ); 1888 1888 } 1889 1889 1890 function kses_init_phishing_filters() { 1891 // Normal filtering 1892 add_filter( 'title_save_pre', 'wp_targeted_link_rel', 0 ); 1893 1894 // Comment filtering 1895 add_filter( 'pre_comment_content', 'wp_targeted_link_rel', 0 ); 1896 1897 // Post filtering 1898 add_filter( 'content_save_pre', 'wp_targeted_link_rel', 0 ); 1899 add_filter( 'excerpt_save_pre', 'wp_targeted_link_rel', 0 ); 1900 add_filter( 'content_filtered_save_pre', 'wp_targeted_link_rel', 0 ); 1901 } 1902 1890 1903 /** 1891 1904 * Removes all Kses input form content filters. 1892 1905 * … … 1932 1945 if ( ! current_user_can( 'unfiltered_html' ) ) { 1933 1946 kses_init_filters(); 1934 1947 } 1948 1949 // Mandatory phishing filters 1950 kses_init_phishing_filters(); 1935 1951 } 1936 1952 1937 1953 /** -
tests/phpunit/tests/formatting/WPTargetedLinkRel.php
1 <?php 2 3 /** 4 * @group formatting 5 */ 6 class Tests_Targeted_Link_Rel extends WP_UnitTestCase { 7 8 public function test_add_no_follow_no_opener_to_links_with_target() { 9 $content = '<p>Links: <a href="/" target="_blank">No rel</a></p>'; 10 $expected = '<p>Links: <a href="/" target="_blank" rel="nofollow noopener">No rel</a></p>'; 11 $this->assertEquals( $expected, wp_targeted_link_rel( $content ) ); 12 } 13 14 public function test_target_as_first_attribute() { 15 $content = '<p>Links: <a target="_blank" href="#">No rel</a></p>'; 16 $expected = '<p>Links: <a target="_blank" href="#" rel="nofollow noopener">No rel</a></p>'; 17 $this->assertEquals( $expected, wp_targeted_link_rel( $content ) ); 18 } 19 20 public function test_add_no_follow_no_opener_to_existing_rel() { 21 $content = '<p>Links: <a href="/" rel="existing values" target="_blank">Existing rel</a></p>'; 22 $expected = '<p>Links: <a href="/" rel="existing values nofollow noopener" target="_blank">Existing rel</a></p>'; 23 $this->assertEquals( $expected, wp_targeted_link_rel( $content ) ); 24 } 25 26 public function test_no_duplicate_values_added() { 27 $content = '<p>Links: <a href="/" rel="existing noopener values" target="_blank">Existing rel</a></p>'; 28 $expected = '<p>Links: <a href="/" rel="existing noopener values nofollow" target="_blank">Existing rel</a></p>'; 29 $this->assertEquals( $expected, wp_targeted_link_rel( $content ) ); 30 } 31 32 public function test_rel_with_single_quote_delimiter() { 33 $content = '<p>Links: <a href="/" rel=\'existing values\' target="_blank">Existing rel</a></p>'; 34 $expected = '<p>Links: <a href="/" rel=\'existing values nofollow noopener\' target="_blank">Existing rel</a></p>'; 35 $this->assertEquals( $expected, wp_targeted_link_rel( $content ) ); 36 } 37 38 public function test_rel_with_no_delimiter() { 39 $content = '<p>Links: <a href="/" rel=existing target="_blank">Existing rel</a></p>'; 40 $expected = '<p>Links: <a href="/" rel="existing nofollow noopener" target="_blank">Existing rel</a></p>'; 41 $this->assertEquals( $expected, wp_targeted_link_rel( $content ) ); 42 } 43 44 public function test_rel_value_spaced_and_no_delimiter() { 45 $content = '<p>Links: <a href="/" rel = existing target="_blank">Existing rel</a></p>'; 46 $expected = '<p>Links: <a href="/" rel="existing nofollow noopener" target="_blank">Existing rel</a></p>'; 47 $this->assertEquals( $expected, wp_targeted_link_rel( $content ) ); 48 } 49 50 public function test_rel_value_spaced_and_no_delimiter_and_values_to_escape() { 51 $content = '<p>Links: <a href="/" rel = existing"value target="_blank">Existing rel</a></p>'; 52 $expected = '<p>Links: <a href="/" rel="existing"value nofollow noopener" target="_blank">Existing rel</a></p>'; 53 $this->assertEquals( $expected, wp_targeted_link_rel( $content ) ); 54 } 55 56 public function test_escaped_quotes() { 57 $content = '<p>Links: <a href=\"/\" rel=\"existing values\" target=\"_blank\">Existing rel</a></p>'; 58 $expected = '<p>Links: <a href=\"/\" rel=\"existing values nofollow noopener\" target=\"_blank\">Existing rel</a></p>'; 59 $this->assertEquals( $expected, wp_targeted_link_rel( $content ) ); 60 } 61 62 public function test_ignore_links_with_no_target() { 63 $content = '<p>Links: <a href="/" target="_blank">Change me</a> <a href="/">Do not change me</a></p>'; 64 $expected = '<p>Links: <a href="/" target="_blank" rel="nofollow noopener">Change me</a> <a href="/">Do not change me</a></p>'; 65 $this->assertEquals( $expected, wp_targeted_link_rel( $content ) ); 66 } 67 } -
tests/phpunit/tests/rest-api/rest-attachments-controller.php
Property changes on: tests/phpunit/tests/formatting/WPTargetedLinkRel.php ___________________________________________________________________ Added: svn:executable ## -0,0 +1 ## +* \ No newline at end of property
1015 1015 'rendered' => '<a href="#">link</a>', 1016 1016 ), 1017 1017 'description' => array( 1018 'raw' => '<a href="#" target="_blank" >link</a>',1019 'rendered' => '<p><a href="#" target="_blank" >link</a></p>',1018 'raw' => '<a href="#" target="_blank" rel="nofollow noopener">link</a>', 1019 'rendered' => '<p><a href="#" target="_blank" rel="nofollow noopener">link</a></p>', 1020 1020 ), 1021 1021 'caption' => array( 1022 'raw' => '<a href="#" target="_blank" >link</a>',1023 'rendered' => '<p><a href="#" target="_blank" >link</a></p>',1022 'raw' => '<a href="#" target="_blank" rel="nofollow noopener">link</a>', 1023 'rendered' => '<p><a href="#" target="_blank" rel="nofollow noopener">link</a></p>', 1024 1024 ), 1025 1025 ), 1026 1026 ), -
tests/phpunit/tests/rest-api/rest-posts-controller.php
3185 3185 'rendered' => '<a href="#">link</a>', 3186 3186 ), 3187 3187 'content' => array( 3188 'raw' => '<a href="#" target="_blank" >link</a>',3189 'rendered' => '<p><a href="#" target="_blank" >link</a></p>',3188 'raw' => '<a href="#" target="_blank" rel="nofollow noopener">link</a>', 3189 'rendered' => '<p><a href="#" target="_blank" rel="nofollow noopener">link</a></p>', 3190 3190 ), 3191 3191 'excerpt' => array( 3192 'raw' => '<a href="#" target="_blank" >link</a>',3193 'rendered' => '<p><a href="#" target="_blank" >link</a></p>',3192 'raw' => '<a href="#" target="_blank" rel="nofollow noopener">link</a>', 3193 'rendered' => '<p><a href="#" target="_blank" rel="nofollow noopener">link</a></p>', 3194 3194 ), 3195 3195 ), 3196 3196 ),