Ticket #43187: 43187.diff

src/wp-includes/default-filters.php

@@ -475 +475 @@
 // Shortcodes
 add_filter( 'the_content', 'do_shortcode', 11 ); // AFTER wpautop()
 
+// Phishing prevention
+add_filter( 'the_content', 'wp_rel_nofollow_noopener', 12 );
+
 // Media
 add_action( 'wp_playlist_scripts', 'wp_playlist_scripts' );
 add_action( 'customize_controls_enqueue_scripts', 'wp_plupload_default_settings' );

src/wp-includes/formatting.php

@@ -2985 +2985 @@
 }
 
 /**
+ * Adds rel nofollow and noopener all HTML A elements in content where target=_blank.
+ *
+ * @param string $text Content that may contain HTML A elements.
+ * @return string Converted content.
+ */
+function wp_rel_nofollow_noopener( $text ) {
+        $text = preg_replace_callback( '|<a (.+_blank.+?)>|i', 'wp_rel_nofollow_noopener_callback', $text );
+        return $text;
+}
+
+/**
+ * Callback to add rel="nofollow noopener" string to HTML A element that
+ * has target=_blank.
+ *
+ * Will remove already existing nofollow and noopener from the
+ * string to prevent from invalidating (X)HTML.
+ *
+ * @param array $matches Single Match
+ * @return string HTML A Element with rel nofollow and noopener if the target is _blank
+ */
+function wp_rel_nofollow_noopener_callback( $matches ) {
+        $text = $matches[1];
+        $atts = shortcode_parse_atts( $matches[1] );
+        $rel  = 'nofollow noopener';
+
+        if ( ! isset( $atts['target'] ) || '_blank' !== $atts['target'] ) {
+                return "<a $text>";
+        }
+
+        if ( ! empty( $atts['rel'] ) ) {
+                $parts = array_map( 'trim', explode( ' ', $atts['rel'] ) );
+                if ( false === array_search( 'nofollow', $parts ) ) {
+                        $parts[] = 'nofollow';
+                }
+                if ( false === array_search( 'noopener', $parts ) ) {
+                        $parts[] = 'noopener';
+                }
+                $rel = implode( ' ', $parts );
+                unset( $atts['rel'] );
+
+                $html = '';
+                foreach ( $atts as $name => $value ) {
+                        $html .= "{$name}=\"$value\" ";
+                }
+                $text = trim( $html );
+        }
+        return "<a $text rel=\"$rel\">";
+}
+
+/**
  * Callback to add rel=nofollow string to HTML A element.
  *
  * Will remove already existing rel="nofollow" and rel='nofollow' from the

tests/phpunit/tests/rest-api/rest-attachments-controller.php

@@ -1016 +1016 @@
                                         ),
                                         'description' => array(
                                                 'raw'      => '<a href="#" target="_blank">link</a>',
-                                                'rendered' => '<p><a href="#" target="_blank">link</a></p>',
+                                                'rendered' => '<p><a href="#" target="_blank" rel="nofollow noopener">link</a></p>',
                                         ),
                                         'caption'     => array(
                                                 'raw'      => '<a href="#" target="_blank">link</a>',

tests/phpunit/tests/rest-api/rest-posts-controller.php

@@ -3186 +3186 @@
                                         ),
                                         'content' => array(
                                                 'raw'      => '<a href="#" target="_blank">link</a>',
-                                                'rendered' => '<p><a href="#" target="_blank">link</a></p>',
+                                                'rendered' => '<p><a href="#" target="_blank" rel="nofollow noopener">link</a></p>',
                                         ),
                                         'excerpt' => array(
                                                 'raw'      => '<a href="#" target="_blank">link</a>',