Changeset 45143

Timestamp:

04/08/2019 11:17:35 PM (5 years ago)

Author:

pento

Message:

Widgets: Add rel="noopener noreferrer" to links with target="_blank" in the Text and HTML widgets.

Props audrasjb, birgire, mukesh27.
Fixes #46421.

Location:

trunk

Files:

• src/wp-includes/widgets/class-wp-widget-custom-html.php (modified) (1 diff)
• src/wp-includes/widgets/class-wp-widget-text.php (modified) (1 diff)
• tests/phpunit/tests/widgets/custom-html-widget.php (modified) (1 diff)
• tests/phpunit/tests/widgets/text-widget.php (modified) (1 diff)

trunk/src/wp-includes/widgets/class-wp-widget-custom-html.php

@@ -143 +143 @@
         /** This filter is documented in wp-includes/widgets/class-wp-widget-text.php */
         $content = apply_filters( 'widget_text', $instance['content'], $simulated_text_widget_instance, $this );
+
+        // Adds noreferrer and noopener relationships, without duplicating values, to all HTML A elements that have a target.
+        $content = wp_targeted_link_rel( $content );
 
         /**

trunk/src/wp-includes/widgets/class-wp-widget-text.php

@@ -328 +328 @@
 
         $text = preg_replace_callback( '#<(video|iframe|object|embed)\s[^>]*>#i', array( $this, 'inject_video_max_width_style' ), $text );
+
+        // Adds noreferrer and noopener relationships, without duplicating values, to all HTML A elements that have a target.
+        $text = wp_targeted_link_rel( $text );
 
         ?>

trunk/tests/phpunit/tests/widgets/custom-html-widget.php

@@ -303 +303 @@
         $this->assertContains( 'Use the Custom HTML widget to add arbitrary HTML code to your widget areas.', $help_tab['content'] );
     }
+
+    /**
+     * Ensure that rel="noopener noreferrer" is added to links with a target.
+     *
+     * @ticket 46421
+     */
+    function test_render_links_with_target() {
+        $widget = new WP_Widget_Custom_HTML();
+
+        $content = 'Test content with an external <a href="https://example.org" target="_blank">link</a>.';
+
+        $args = array(
+            'before_title'  => '<h2>',
+            'after_title'   => '</h2>',
+            'before_widget' => '',
+            'after_widget'  => '',
+        );
+
+        $instance = array(
+            'title'   => 'Foo',
+            'content' => $content,
+        );
+
+        $output = get_echo( array( $widget, 'widget' ), array( $args, $instance ) );
+        $this->assertContains( 'rel="noopener noreferrer"', $output );
+    }
+
+    /**
+     * Ensure that rel="noopener noreferrer" is not added to links without a target.
+     *
+     * @ticket 46421
+     */
+    function test_render_links_without_target() {
+        $widget = new WP_Widget_Custom_HTML();
+
+        $content = 'Test content with an internal <a href="/">link</a>.';
+
+        $args = array(
+            'before_title'  => '<h2>',
+            'after_title'   => '</h2>',
+            'before_widget' => '',
+            'after_widget'  => '',
+        );
+
+        $instance = array(
+            'title'   => 'Foo',
+            'content' => $content,
+        );
+
+        $output = get_echo( array( $widget, 'widget' ), array( $args, $instance ) );
+        $this->assertNotContains( 'rel="noopener noreferrer"', $output );
+    }
+
 }

trunk/tests/phpunit/tests/widgets/text-widget.php

@@ -1002 +1002 @@
         $this->assertContains( '<script type="text/html" id="tmpl-widget-text-control-fields">', $output );
     }
+
+    /**
+     * Ensure that rel="noopener noreferrer" is added to links with a target.
+     *
+     * @ticket 46421
+     */
+    function test_render_links_with_target() {
+        $widget = new WP_Widget_Text();
+
+        $text = 'Test content with an external <a href="https://example.org" target="_blank">link</a>.';
+
+        $args = array(
+            'before_title'  => '<h2>',
+            'after_title'   => '</h2>',
+            'before_widget' => '',
+            'after_widget'  => '',
+        );
+
+        $instance = array(
+            'title' => 'Foo',
+            'text'  => $text,
+        );
+
+        $output = get_echo( array( $widget, 'widget' ), array( $args, $instance ) );
+
+        $this->assertContains( 'rel="noopener noreferrer"', $output );
+    }
+
+    /**
+     * Ensure that rel="noopener noreferrer" is not added to links without a target.
+     *
+     * @ticket 46421
+     */
+    function test_render_links_without_target() {
+        $widget = new WP_Widget_Text();
+
+        $text = 'Test content with an internal <a href="/">link</a>.';
+
+        $args = array(
+            'before_title'  => '<h2>',
+            'after_title'   => '</h2>',
+            'before_widget' => '',
+            'after_widget'  => '',
+        );
+
+        $instance = array(
+            'title' => 'Foo',
+            'text'  => $text,
+        );
+
+        $output = get_echo( array( $widget, 'widget' ), array( $args, $instance ) );
+
+        $this->assertNotContains( 'rel="noopener noreferrer"', $output );
+    }
 }