Ticket #43280: 43280.4.diff

src/wp-includes/widgets/class-wp-widget-media-image.php

@@ -261 +261 @@
                                 $link .= sprintf( ' rel="%s"', esc_attr( $instance['link_rel'] ) );
                         }
                         if ( ! empty( $instance['link_target_blank'] ) ) {
+                                if ( empty( $instance['link_rel'] ) ) {
+                                        $link .= ' rel="noopener noreferrer"';
+                                }
                                 $link .= ' target="_blank"';
                         }
                         $link .= '>';

tests/phpunit/tests/widgets/media-image-widget.php

@@ -509 +509 @@
 
                 $this->assertContains( '<a href="https://example.org"', $output );
                 $this->assertContains( 'target="_blank"', $output );
+                $this->assertContains( 'rel="noopener noreferrer"', $output );
 
                 // Populate caption in attachment.
                 wp_update_post(