Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 13 additions & 1 deletion apps/meteor/client/components/MarkdownText.tsx
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ marked.Lexer.rules.gfm = {
};

const linkMarked = (href: string | null, _title: string | null, text: string): string =>
`<a href="${href}" target="_blank" rel="nofollow">${text}</a> `;
`<a href="${href}" target="_blank" rel="nofollow noopener noreferrer">${text}</a> `;
const paragraphMarked = (text: string): string => text;
const brMarked = (): string => ' ';
const listItemMarked = (text: string): string => {
Expand All @@ -46,6 +46,9 @@ inlineRenderer.hr = horizontalRuleMarked;
inlineWithoutBreaks.link = linkMarked;
inlineWithoutBreaks.paragraph = paragraphMarked;
inlineWithoutBreaks.br = brMarked;
inlineWithoutBreaks.image = brMarked;
inlineWithoutBreaks.code = paragraphMarked;
inlineWithoutBreaks.codespan = paragraphMarked;
inlineWithoutBreaks.listitem = listItemMarked;
inlineWithoutBreaks.hr = horizontalRuleMarked;

Expand Down Expand Up @@ -118,6 +121,15 @@ const MarkdownText: FC<Partial<MarkdownTextParams>> = ({
}
})();

// Add a hook to make all links open a new window
dompurify.addHook('afterSanitizeAttributes', (node) => {
// set all elements owning target to target=_blank
if ('target' in node) {
node.setAttribute('target', '_blank');
node.setAttribute('rel', 'nofollow noopener noreferrer');
}
});

return preserveHtml ? html : html && sanitizer(html, { ADD_ATTR: ['target'], ALLOWED_URI_REGEXP: getRegexp(schemes) });
}, [preserveHtml, sanitizer, content, variant, markedOptions, parseEmoji, schemes]);

Expand Down
4 changes: 2 additions & 2 deletions apps/meteor/client/views/room/Announcement/Announcement.tsx
Original file line number Diff line number Diff line change
Expand Up @@ -31,15 +31,15 @@ const Announcement: FC<AnnouncementParams> = ({ announcement, announcementDetail
: setModal(
<GenericModal icon={null} title={t('Announcement')} confirmText={t('Close')} onConfirm={closeModal} onClose={closeModal}>
<Box>
<MarkdownText content={announcement} />
<MarkdownText content={announcement} parseEmoji />
</Box>
</GenericModal>,
);
};

return announcement ? (
<AnnouncementComponent onClickOpen={(e: MouseEvent<HTMLAnchorElement>): void => handleClick(e)}>
<MarkdownText variant='inlineWithoutBreaks' content={announcement} withTruncatedText />
<MarkdownText variant='inlineWithoutBreaks' content={announcement} withTruncatedText parseEmoji />
</AnnouncementComponent>
) : null;
};
Expand Down