diff --git a/js/src/components/Editor.vue b/js/src/components/Editor.vue index f0b5a0eac..3e6491b76 100644 --- a/js/src/components/Editor.vue +++ b/js/src/components/Editor.vue @@ -250,7 +250,9 @@ export default class EditorComponent extends Vue { Mention.configure(MentionOptions), CustomImage, Underline, - Link, + Link.configure({ + HTMLAttributes: { target: "_blank", rel: "noopener noreferrer ugc" }, + }), CharacterCount.configure({ limit: this.maxSize, }), diff --git a/lib/service/formatter/default_scrubbler.ex b/lib/service/formatter/default_scrubbler.ex index 001207216..70372d5b8 100644 --- a/lib/service/formatter/default_scrubbler.ex +++ b/lib/service/formatter/default_scrubbler.ex @@ -36,6 +36,11 @@ defmodule Mobilizon.Service.Formatter.DefaultScrubbler do "ugc" ]) + # Rel attributes are separated by spaces + Meta.allow_tag_with_this_attribute_values(:a, "rel", [ + "noopener noreferrer ugc" + ]) + Meta.allow_tag_with_these_attributes(:a, ["name", "title", "target"]) Meta.allow_tag_with_these_attributes(:abbr, ["title"])