From 248583b44340c12f9c1e4aba98998af77d0f9693 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Toma=C5=BE=20Jerman?= <tomaz.jerman121@gmail.com>
Date: Tue, 15 Mar 2022 12:43:00 +0100
Subject: [PATCH] Tweak link sanitation

---
 pkg/locale/input_test.go | 3 +++
 pkg/xss/rich_text.go     | 4 ++++
 2 files changed, 7 insertions(+)

diff --git a/pkg/locale/input_test.go b/pkg/locale/input_test.go
index 06c679223..fa44dbc4f 100644
--- a/pkg/locale/input_test.go
+++ b/pkg/locale/input_test.go
@@ -16,6 +16,9 @@ func Test_SanitizeMessage(t *testing.T) {
 		{"accents", "čšž", "čšž"},
 		{"safe html", "<b>čšž</b>", "<b>čšž</b>"},
 		{"unsafe html", `<a href="javascript:document.location='https://cortezaproject.org/'">XSS</A>`, "XSS"},
+
+		{"regular link", `<a href="https://cortezaproject.org/">home</a>`, `<a href="https://cortezaproject.org/" rel="nofollow">home</a>`},
+		{"link with target", `<a href="https://cortezaproject.org/" target="_blank">home</a>`, `<a href="https://cortezaproject.org/" target="_blank" rel="nofollow noopener">home</a>`},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
diff --git a/pkg/xss/rich_text.go b/pkg/xss/rich_text.go
index 47dc576f1..7c7cdc21c 100644
--- a/pkg/xss/rich_text.go
+++ b/pkg/xss/rich_text.go
@@ -17,6 +17,10 @@ func RichText(in string) string {
 	p.AllowStyles("color").Matching(regexp.MustCompile("(?i)^#([0-9a-f]{3,4}|[0-9a-f]{6}|[0-9a-f]{8})$")).Globally()
 	p.AllowStyles("background-color").Matching(regexp.MustCompile("(?i)^#([0-9a-f]{3,4}|[0-9a-f]{6}|[0-9a-f]{8})$")).Globally()
 
+	// some link specifics we need; allow target but assure safety
+	p.AllowAttrs("target").OnElements("a")
+	p.AddTargetBlankToFullyQualifiedLinks(false)
+
 	sanitized := p.Sanitize(in)
 
 	// handle escaped strings and unescape them