SONAR-17579 add security Link attributes noopener and noreferrer

3 files changed, 8 insertions, 4 deletions

diff --git a/sonar-markdown/src/main/java/org/sonar/markdown/HtmlLinkChannel.java b/sonar-markdown/src/main/java/org/sonar/markdown/HtmlLinkChannel.java
index cccae47ce95..66e88e15c5f 100644
--- a/sonar-markdown/src/main/java/org/sonar/markdown/HtmlLinkChannel.java
+++ b/sonar-markdown/src/main/java/org/sonar/markdown/HtmlLinkChannel.java
@@ -49,7 +49,7 @@ class HtmlLinkChannel extends RegexChannel<MarkdownOutput> {
     String url = matcher.group(2);
     output.append("<a href=\"");
     output.append(url);
-    output.append("\" target=\"_blank\">");
+    output.append("\" target=\"_blank\" rel=\"noopener noreferrer\">");
     output.append(content);
     output.append("</a>");
   }
diff --git a/sonar-markdown/src/main/java/org/sonar/markdown/HtmlUrlChannel.java b/sonar-markdown/src/main/java/org/sonar/markdown/HtmlUrlChannel.java
index 5aadee1a0fb..50424d4b0c3 100644
--- a/sonar-markdown/src/main/java/org/sonar/markdown/HtmlUrlChannel.java
+++ b/sonar-markdown/src/main/java/org/sonar/markdown/HtmlUrlChannel.java
@@ -33,6 +33,10 @@ class HtmlUrlChannel extends RegexChannel<MarkdownOutput> {
 
   @Override
   protected void consume(CharSequence token, MarkdownOutput output) {
-    output.append("<a href=\"" + token + "\" target=\"_blank\">" + token + "</a>");
+    output.append("<a href=\"");
+    output.append(token);
+    output.append("\" target=\"_blank\" rel=\"noopener noreferrer\">");
+    output.append(token);
+    output.append("</a>");
   }
 }
diff --git a/sonar-markdown/src/test/java/org/sonar/markdown/MarkdownTest.java b/sonar-markdown/src/test/java/org/sonar/markdown/MarkdownTest.java
index d0c64578bb2..b4838a12d8d 100644
--- a/sonar-markdown/src/test/java/org/sonar/markdown/MarkdownTest.java
+++ b/sonar-markdown/src/test/java/org/sonar/markdown/MarkdownTest.java
@@ -28,13 +28,13 @@ public class MarkdownTest {
   @Test
   public void shouldDecorateUrl() {
     assertThat(Markdown.convertToHtml("http://google.com"))
-        .isEqualTo("<a href=\"http://google.com\" target=\"_blank\">http://google.com</a>");
+        .isEqualTo("<a href=\"http://google.com\" target=\"_blank\" rel=\"noopener noreferrer\">http://google.com</a>");
   }
 
   @Test
   public void shouldDecorateDocumentedLink() {
     assertThat(Markdown.convertToHtml("For more details, please [check online documentation](http://docs.sonarqube.org/display/SONAR)."))
-        .isEqualTo("For more details, please <a href=\"http://docs.sonarqube.org/display/SONAR\" target=\"_blank\">check online documentation</a>.");
+        .isEqualTo("For more details, please <a href=\"http://docs.sonarqube.org/display/SONAR\" target=\"_blank\" rel=\"noopener noreferrer\">check online documentation</a>.");
   }