Add rel="noopener" to target="_blank" links by default in menu walker

[audrasjb]

WordPress core previously introduced rel="noopener" attribute to target="_blank" links –which is fine– but I think menu items should also add this attribute to target-blank links.

I know there is already an optional "Link Relationship (XFN)" text input but 1) It's optional and tricky for unexperimented users ; 2) I think we should add rel="noopener" attribute by default when "Open link in a new tab" option is checked and "Link Relationship (XFN)" input is empty.

Related: #43280 , #37941

[audrasjb]

adds default noopener value to menu items with target blank attribute

[welcher]

@audrasjb thanks for the ticket and the patch.

My only thought here is that we should also be adding noreferrer as well to keep our approach consistent with #37941

[audrasjb]

Adds both noopener and noreferrer values and refreshes the patch against trunk

[audrasjb]

You're alright @welcher
Patch adds both values now and is refreshed against trunk.

Cheers,
Jb

[pento]

Patch needs review and a decision.

[welcher]

Patch looks good to me.

@pento is it too late to get this into 5.1?

It would make sense to get this and #43280 into core at the same time.

[pento]

Thanks for the ping, @welcher!

As this is an enhancement, (though a small one), we're already past the deadline for getting it committed. I like the idea, I think it's reasonable to commit it for 5.2.

In the mean time, it'd be nice to have some unit tests for this behaviour.

[welcher]

Adds some unit tests

[audrasjb]

43290.3.diff looks great on my side. Thanks for the unit-tests!

[afercia]

As mentioned on #46421, I'd suggest to investigate on the actual usefulness of noreferrer:

• it was used to support old browsers that had no support for noopener, see ​https://mathiasbynens.github.io/rel-noopener/ under "Recommendations" for browsers details
• seems redundant after [41741] see #42036

[audrasjb]

Replying to afercia:

As mentioned on #46421, I'd suggest to investigate on the actual usefulness of noreferrer:

• it was used to support old browsers that had no support for noopener, see ​https://mathiasbynens.github.io/rel-noopener/ under "Recommendations" for browsers details
• seems redundant after [41741] see #42036

As mentionned on #43280 I think both of the rel attributes should be added, in order to keep some consistency with ​https://developer.wordpress.org/reference/functions/wp_targeted_link_rel/

If we want to remove noreferrer, I believe we should remove it from that function first ;)

[audrasjb]

Changing ticket type to Defect/bug. See https://core.trac.wordpress.org/ticket/43280#comment:18 for context.

[welcher]

@afercia I would lean towards keeping them both in place.

Both for consistency as @audrasjb points out, and also as these menus are shown on the front end nd I don't believe the patch in [41741] addresses that use case.

[audrasjb]

I think we are good to land in 5.2 here :-)

[pento]

In 45141:

Menus: Add rel="noopener" to target="_blank" links by default in menus.

This expands upon rel="noopener" being previously added to links in the content.

Props audrasjb, welcher.
Fixes #43290.