From 7f194bee69c26f1b20c4a0f3b0750e39fc782e1d Mon Sep 17 00:00:00 2001
From: dab246 <tdvu@linagora.com>
Date: Tue, 1 Aug 2023 12:57:28 +0700
Subject: [PATCH] TF-2047 Add `rel="noreferrer"` to HTML link attribute for
 enhance website security

(cherry picked from commit b015274879585eb36dd8e29b4781b7a9ac638888)
---
 .../dom/add_target_blank_in_tag_a_transformers.dart           | 4 ++++
 .../utils/html_transformer/sanitize_autolink_filter.dart      | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/core/lib/presentation/utils/html_transformer/dom/add_target_blank_in_tag_a_transformers.dart b/core/lib/presentation/utils/html_transformer/dom/add_target_blank_in_tag_a_transformers.dart
index d9454297d..59c46f627 100644
--- a/core/lib/presentation/utils/html_transformer/dom/add_target_blank_in_tag_a_transformers.dart
+++ b/core/lib/presentation/utils/html_transformer/dom/add_target_blank_in_tag_a_transformers.dart
@@ -14,6 +14,10 @@ class AddTargetBlankInTagATransformer extends DomTransformer {
     final elements = document.querySelectorAll('a');
     await Future.wait(elements.map((element) async {
       element.attributes['target'] = '_blank';
+      final rel = element.attributes['rel'];
+      if (rel == null || (!rel.contains('noopener') && !rel.contains('noreferrer'))) {
+        element.attributes['rel'] = 'noreferrer';
+      }
     }));
   }
 }
diff --git a/core/lib/presentation/utils/html_transformer/sanitize_autolink_filter.dart b/core/lib/presentation/utils/html_transformer/sanitize_autolink_filter.dart
index a47209eb0..86b2712db 100644
--- a/core/lib/presentation/utils/html_transformer/sanitize_autolink_filter.dart
+++ b/core/lib/presentation/utils/html_transformer/sanitize_autolink_filter.dart
@@ -56,7 +56,7 @@ class SanitizeAutolinkFilter {
   }
 
   String _buildUrlLinkTag({required String urlLink, required String value}) {
-    return '<a href="$urlLink" target="_blank">$value</a>';
+    return '<a href="$urlLink" target="_blank" rel="noreferrer">$value</a>';
   }
 
   String _buildEmailLinkTag({required String mailToLink, required String value}) {