Tweak link sanitation

pkg/locale/input_test.go

@@ -16,6 +16,9 @@ func Test_SanitizeMessage(t *testing.T) {
 		{"accents", "čšž", "čšž"},
 		{"safe html", "<b>čšž</b>", "<b>čšž</b>"},
 		{"unsafe html", `<a href="javascript:document.location='https://cortezaproject.org/'">XSS</A>`, "XSS"},
+
+		{"regular link", `<a href="https://cortezaproject.org/">home</a>`, `<a href="https://cortezaproject.org/" rel="nofollow">home</a>`},
+		{"link with target", `<a href="https://cortezaproject.org/" target="_blank">home</a>`, `<a href="https://cortezaproject.org/" target="_blank" rel="nofollow noopener">home</a>`},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {

pkg/xss/rich_text.go

@@ -17,6 +17,10 @@ func RichText(in string) string {
 	p.AllowStyles("color").Matching(regexp.MustCompile("(?i)^#([0-9a-f]{3,4}|[0-9a-f]{6}|[0-9a-f]{8})$")).Globally()
 	p.AllowStyles("background-color").Matching(regexp.MustCompile("(?i)^#([0-9a-f]{3,4}|[0-9a-f]{6}|[0-9a-f]{8})$")).Globally()
 
+	// some link specifics we need; allow target but assure safety
+	p.AllowAttrs("target").OnElements("a")
+	p.AddTargetBlankToFullyQualifiedLinks(false)
+
 	sanitized := p.Sanitize(in)
 
 	// handle escaped strings and unescape them