Skip to content
This repository has been archived by the owner on Jun 26, 2020. It is now read-only.

Commit

Permalink
Merge pull request #251 from ckeditor/i/5746
Browse files Browse the repository at this point in the history
Fix: Link preview in the balloon should have `rel="noopener noreferrer"` set for security reasons. Closes ckeditor/ckeditor5#5746.
  • Loading branch information
jodator authored Nov 18, 2019
2 parents f75bf00 + 5c46297 commit 5b921b4
Show file tree
Hide file tree
Showing 2 changed files with 7 additions and 2 deletions.
3 changes: 2 additions & 1 deletion src/ui/linkactionsview.js
Original file line number Diff line number Diff line change
Expand Up @@ -209,7 +209,8 @@ export default class LinkActionsView extends View {
'ck-link-actions__preview'
],
href: bind.to( 'href', href => href && ensureSafeUrl( href ) ),
target: '_blank'
target: '_blank',
rel: 'noopener noreferrer'
}
} );

Expand Down
6 changes: 5 additions & 1 deletion tests/ui/linkactionsview.js
Original file line number Diff line number Diff line change
Expand Up @@ -84,10 +84,14 @@ describe( 'LinkActionsView', () => {
expect( view.previewButtonView.element.classList.contains( 'ck-link-actions__preview' ) ).to.be.true;
} );

it( 'has a target attribute', () => {
it( 'has a "target" attribute', () => {
expect( view.previewButtonView.element.getAttribute( 'target' ) ).to.equal( '_blank' );
} );

it( 'has a "rel" attribute', () => {
expect( view.previewButtonView.element.getAttribute( 'rel' ) ).to.equal( 'noopener noreferrer' );
} );

describe( '<a> bindings', () => {
it( 'binds href DOM attribute to view#href', () => {
expect( view.previewButtonView.element.getAttribute( 'href' ) ).to.be.null;
Expand Down

0 comments on commit 5b921b4

Please sign in to comment.