Changeset 41409 for branches/3.9

Timestamp:

09/19/2017 10:15:37 AM (9 years ago)

Author:

ocean90

Message:

Editor: Prevent adding javascript: and data: URLs through the inline link dialog.

Merge of [41393] to the 3.9 branch.

Location:

branches/3.9

Files:

• . (modified) (1 prop)
• src/wp-includes/js/wplink.js (modified) (3 diffs)

branches/3.9/src/wp-includes/js/wplink.js

@@ -180 +180 @@
                         attrs = wpLink.getAttrs();
 
+                        var parser = document.createElement( 'a' );
+                        parser.href = attrs.href;
+
+                        if ( 'javascript:' === parser.protocol || 'data:' === parser.protocol ) { // jshint ignore:line
+                                attrs.href = '';
+                        }
+
                         // If there's no href, return.
                         if ( ! attrs.href || attrs.href == 'http://' )
@@ -193 +200 @@
 
                         if ( attrs.target ) {
-                                html += ' target="' + attrs.target + '"';
+                                html += ' rel="noopener" target="' + attrs.target + '"';
                         }
 
@@ -244 +251 @@
 
                         link = editor.dom.getParent( editor.selection.getNode(), 'a[href]' );
+
+                        var parser = document.createElement( 'a' );
+                        parser.href = attrs.href;
+
+                        if ( 'javascript:' === parser.protocol || 'data:' === parser.protocol ) { // jshint ignore:line
+                                attrs.href = '';
+                        }
 
                         // If the values are empty, unlink and return