Add attribute rel to default attributes

[Jonas Grillères]

It is recommended to add attribute: rel="noopener, noreferrer" to links opening in a new tab with attribute target="_blank". See tabnabbing.

In the current situation, it is not possible to use target and ref attributes together without overriding allowedAttributes list.

Does it make sense to add rel attribute in the list of the defaults attributes?

sanitize-html/index.js

Line 806 in 795d079

 a: [ 'href', 'name', 'target' ], 

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[Daniel Nitu]

I ended up extending the default list, but it would be good to have rel included by default - or at least know why it's not included.

  const options = {
    allowedAttributes: {
      ...sanitize.defaults.allowedAttributes,
      a: ['href', 'name', 'target', 'rel'],
    },
  };

  const sanitizedHtml = sanitize(dirty, options)

[Tom Boutell]

I think a PR to add it would be reasonable. I don’t see a situation where it would be considered harmful but target would not.

…

On Thu, Oct 5, 2023 at 4:29 AM Daniel Nitu ***@***.***> wrote: I ended up extending the default list, but it would be good to have rel included by default - or at least know why it's not included. const options = { allowedAttributes: { ...sanitize.defaults.allowedAttributes, a: ['href', 'name', 'target', 'rel'], }, }; const sanitizedHtml = sanitize(dirty, options) — Reply to this email directly, view it on GitHub <#584 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAH27IALJK33JJMT7UHH5DX5ZVW7AVCNFSM6AAAAAASN2LVQ6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTONBYGM3DSNJUGI> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>