Changeset 41410

Timestamp:

09/19/2017 10:15:40 AM (8 years ago)

Author:

ocean90

Message:

Editor: Prevent adding javascript: and data: URLs through the inline link dialog.

Merge of [41393] to the 3.8 branch.

Location:

branches/3.8

Files:

• . (modified) (1 prop)
• src/wp-includes/js/wplink.js (modified) (3 diffs)

branches/3.8/src/wp-includes/js/wplink.js

@@ -166 +166 @@
             attrs = wpLink.getAttrs();
 
+            var parser = document.createElement( 'a' );
+            parser.href = attrs.href;
+
+            if ( 'javascript:' === parser.protocol || 'data:' === parser.protocol ) { // jshint ignore:line
+                attrs.href = '';
+            }
+
             // If there's no href, return.
             if ( ! attrs.href || attrs.href == 'http://' )
@@ -176 +183 @@
                 html += ' title="' + attrs.title + '"';
             if ( attrs.target )
-                html += ' target="' + attrs.target + '"';
+                html += ' rel="noopener" target="' + attrs.target + '"';
 
             html += '>';
@@ -221 +228 @@
             tinyMCEPopup.restoreSelection();
             e = ed.dom.getParent(ed.selection.getNode(), 'A');
+
+            var parser = document.createElement( 'a' );
+            parser.href = attrs.href;
+
+            if ( 'javascript:' === parser.protocol || 'data:' === parser.protocol ) { // jshint ignore:line
+                attrs.href = '';
+            }
 
             // If the values are empty, unlink and return