apostrophecms/sanitize-html

Add attribute rel to default attributes

jonasgrilleres opened this issue · 3 comments

jonasgrilleres commented

It is recommended to add attribute: rel="noopener, noreferrer" to links opening in a new tab with attribute target="_blank". See tabnabbing.

In the current situation, it is not possible to use target and ref attributes together without overriding allowedAttributes list.

Does it make sense to add rel attribute in the list of the defaults attributes?

sanitize-html/index.js

Line 806 in 795d079

a: [ 'href', 'name', 'target' ],

stale commented

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

danielnitu commented

I ended up extending the default list, but it would be good to have rel included by default - or at least know why it's not included.

  const options = {
    allowedAttributes: {
      ...sanitize.defaults.allowedAttributes,
      a: ['href', 'name', 'target', 'rel'],
    },
  };

  const sanitizedHtml = sanitize(dirty, options)
boutell commented