From 0224b79ccda081669145e8a92118e55632648771 Mon Sep 17 00:00:00 2001
From: Marius Balteanu <marius.balteanu@zitec.com>
Date: Tue, 27 Sep 2022 17:10:14 +0000
Subject: [PATCH] Merged r21849 from trunk to 5.0-stable (#37713).

git-svn-id: https://svn.redmine.org/redmine/branches/5.0-stable@21858 e93f8b46-1217-0410-a6f0-8f06a7374b81
---
 .../wiki_formatting/common_mark/external_links_filter.rb    | 6 ++++++
 .../common_mark/external_links_filter_test.rb               | 5 +++++
 2 files changed, 11 insertions(+)

diff --git a/lib/redmine/wiki_formatting/common_mark/external_links_filter.rb b/lib/redmine/wiki_formatting/common_mark/external_links_filter.rb
index 4c25a7b13..a62ac680f 100644
--- a/lib/redmine/wiki_formatting/common_mark/external_links_filter.rb
+++ b/lib/redmine/wiki_formatting/common_mark/external_links_filter.rb
@@ -39,6 +39,12 @@ module Redmine
               klass,
               (scheme == "mailto" ? "email" : "external")
             ].compact.join " "
+
+            if node["target"].present? && scheme != "mailto"
+              rel = node["rel"]&.split || []
+              rel << "noopener"
+              node["rel"] = rel.join(" ")
+            end
           end
           doc
         end
diff --git a/test/unit/lib/redmine/wiki_formatting/common_mark/external_links_filter_test.rb b/test/unit/lib/redmine/wiki_formatting/common_mark/external_links_filter_test.rb
index d4b76c401..f46f69c2e 100644
--- a/test/unit/lib/redmine/wiki_formatting/common_mark/external_links_filter_test.rb
+++ b/test/unit/lib/redmine/wiki_formatting/common_mark/external_links_filter_test.rb
@@ -50,5 +50,10 @@ if Object.const_defined?(:CommonMarker)
         filter(%(<a href="http://example.com/foo#bar#">Malformed URI</a>))
       end
     end
+
+    def test_external_links_with_target_get_rel_noopener
+      assert_equal %(<a target="_blank" href="http://example.net/" class="external" rel="noopener">link</a>), filter(%(<a target="_blank" href="http://example.net/">link</a>))
+      assert_equal %(<a target="_blank" href="http://example.net/" rel="nofollow noopener" class="external">link</a>), filter(%(<a target="_blank" href="http://example.net/" rel="nofollow">link</a>))
+    end
   end
 end
-- 
2.39.5