See D19117. Instead of automatically figuring this out inside phutil_tag(), explicitly add rel="noreferrer" at the application level to all external links.
Details
Details
- Reviewers
- None
- Commits
- rP05a4c55c52be: Explicitly add rel="noreferrer" to all external links
- Grepped for _blank, isValidRemoteURIForLink, checked all callsites for user-controlled data.
- Created a link menu item, verified noreferrer in markup.
- Created a link custom field, verified no referrer in markup.
- Verified noreferrer for {nav href=...}.
Diff Detail
Diff Detail
- Repository
- rP Phabricator
- Lint
Lint Not Applicable - Unit
Tests Not Applicable
Event Timeline
| src/applications/files/markup/PhabricatorImageRemarkupRule.php | ||
|---|---|---|
| 23 | This was rendering <img href="..." /> which has no effect since href doesn't go on img. | |