Changeset 41402 for branches/4.6

Timestamp:

09/19/2017 10:14:53 AM (8 years ago)

Author:

ocean90

Message:

Editor: Prevent adding javascript: and data: URLs through the inline link dialog.

Merge of [41393] to the 4.6 branch.

Location:

branches/4.6

Files:

• . (modified) (1 prop)
• src/wp-includes/js/tinymce/plugins/wplink/plugin.js (modified) (2 diffs)
• src/wp-includes/js/wplink.js (modified) (3 diffs)

branches/4.6/src/wp-includes/js/tinymce/plugins/wplink/plugin.js

@@ -5 +5 @@
             return (
                 '<div id="' + this._id + '" class="wp-link-preview">' +
-                    '<a href="' + this.url + '" target="_blank" tabindex="-1">' + this.url + '</a>' +
+                    '<a href="' + this.url + '" target="_blank" rel="noopener" tabindex="-1">' + this.url + '</a>' +
                 '</div>'
             );
@@ -249 +249 @@
                 text = inputInstance.getLinkText();
                 editor.focus();
+
+                var parser = document.createElement( 'a' );
+                parser.href = href;
+
+                if ( 'javascript:' === parser.protocol || 'data:' === parser.protocol ) { // jshint ignore:line
+                    href = '';
+                }
 
                 if ( ! href ) {

branches/4.6/src/wp-includes/js/wplink.js

@@ -317 +317 @@
 
             if ( attrs.target ) {
-                html += ' target="' + attrs.target + '"';
+                html += ' rel="noopener" target="' + attrs.target + '"';
             }
 
@@ -341 +341 @@
             attrs = wpLink.getAttrs();
             text = inputs.text.val();
+
+            var parser = document.createElement( 'a' );
+            parser.href = attrs.href;
+
+            if ( 'javascript:' === parser.protocol || 'data:' === parser.protocol ) { // jshint ignore:line
+                attrs.href = '';
+            }
 
             // If there's no href, return.
@@ -397 +404 @@
                 editor.selection.moveToBookmark( editor.windowManager.wplinkBookmark );
                 editor.windowManager.wplinkBookmark = null;
+            }
+
+            var parser = document.createElement( 'a' );
+            parser.href = attrs.href;
+
+            if ( 'javascript:' === parser.protocol || 'data:' === parser.protocol ) { // jshint ignore:line
+                attrs.href = '';
             }