issue2551098: markdown links missing rel="noreferer nofollow"

Links generated by all markdown backends are missing the noopener and
nofollow relation that roundup's normal text -> html core adds to
prevent security issues and link spam.

Now rel="nofollow" is added to links generated by markdown2 backends
and rel="nofollow noopener" for mistune and markdown backends.

Markdown2 isn't as programable as the other two backends so I used the
built-in nofollow support. This means that a user that generates a
link that opens in a new window can manpulate the parent window.

Author: rouilj

roundup/cgi/templating.py

@@ -70,7 +70,7 @@ class Markdown(markdown2.Markdown):
             _safe_protocols = re.compile('(?!' + ':|'.join([re.escape(s) for s in _disable_url_schemes]) + ':)', re.IGNORECASE)
 
         def _extras(config):
-            extras = { 'fenced-code-blocks' : {} }
+            extras = { 'fenced-code-blocks' : {}, 'nofollow': None }
             if config['MARKDOWN_BREAK_ON_NEWLINE']:
                 extras['break-on-newline'] = True
             return extras
@@ -96,7 +96,21 @@ def run(self, root):
                             if url.startswith(s + ':'):
                                 el.attrib['href'] = '#'
 
+        class LinkRendererWithRel(Treeprocessor):
+            ''' Rendering class that sets the rel="nofollow noreferer"
+                for links. '''
+            rel_value = "nofollow noopener"
+
+            def run(self, root):
+                for el in root.iter('a'):
+                    if 'href' in el.attrib:
+                        url = el.get('href').lstrip(' \r\n\t\x1a\0').lower()
+                        if not url.startswith('http'):  # only add rel for absolute http url's
+                            continue
+                        el.set('rel', self.rel_value)
+
         # make sure any HTML tags get escaped and some links restricted
+        # and rel="nofollow noopener" are added to links
         class SafeHtml(MarkdownExtension):
             def extendMarkdown(self, md, md_globals=None):
                 if hasattr(md.preprocessors, 'deregister'):
@@ -112,7 +126,11 @@ def extendMarkdown(self, md, md_globals=None):
                     md.treeprocessors.register(RestrictLinksProcessor(), 'restrict_links', 0)
                 else:
                     md.treeprocessors['restrict_links'] = RestrictLinksProcessor()
-
+                if hasattr(md.preprocessors, 'register'):
+                    md.treeprocessors.register(LinkRendererWithRel(), 'add_link_rel', 0)
+                else:
+                    md.treeprocessors['add_link_rel'] = LinkRendererWithRel()
+                
         def _extensions(config):
             extensions = [SafeHtml(), 'fenced_code']
             if config['MARKDOWN_BREAK_ON_NEWLINE']:
@@ -128,10 +146,44 @@ def _extensions(config):
 def _import_mistune():
     try:
         import mistune
+        from mistune import Renderer, escape_link, escape
+
         mistune._scheme_blacklist = [ s + ':' for s in _disable_url_schemes ]
 
+        class LinkRendererWithRel(Renderer):
+            ''' Rendering class that sets the rel="nofollow noreferer"
+                for links. '''
+
+            rel_value = "nofollow noopener"
+
+            def autolink(self, link, is_email=False):
+                ''' handle <url or email> style explicit links '''
+                text = link = escape_link(link)
+                if is_email:
+                    link = 'mailto:%s' % link
+                    return '<a href="%(href)s">%(text)s</a>' % { 'href': link, 'text': text }
+                return '<a href="%(href)s" rel="%(rel)s">%(href)s</a>' % {
+                    'rel': self.rel_value, 'href': escape_link(link)}
+
+            def link(self, link, title, content):
+                ''' handle [text](url "title") style links and Reference
+                    links '''
+
+                values = {
+                    'content': escape(content),
+                    'href': escape_link(link),
+                    'rel': self.rel_value,
+                    'title': escape(title) if title else '', 
+                }
+
+                if title:
+                    return '<a href="%(href)s" rel="%(rel)s" ' \
+                            'title="%(title)s">%(content)s</a>' % values
+
+                return '<a href="%(href)s" rel="%(rel)s">%(content)s</a>' % values
+
         def _options(config):
-            options = {}
+            options = {'renderer': LinkRendererWithRel(escape = True)}
             if config['MARKDOWN_BREAK_ON_NEWLINE']:
                 options['hard_wrap'] = True
             return options

test/test_templating.py

@@ -420,6 +420,45 @@ def test_input_xhtml(self):
 
 # common markdown test cases
 class MarkdownTests:
+    def mangleMarkdown2(self, s):
+        ''' markdown2's rel=nofollow support on 'a' tags isn't programmable.
+            So we are using it's builtin nofollow support. Mangle the string
+            so that it matches the test case.
+
+                turn: <a rel="nofollow" href="foo"> into
+                      <a href="foo" rel="nofollow noopener">
+
+            Also if it is a mailto url, we don't expect rel="nofollow",
+            so delete it.
+
+                turn: <a rel="nofollow" href="mailto:foo"> into
+                      <a href="mailto:foo">
+
+            Also when a title is present it is put in a different place
+            from markdown, so fix it to normalize.
+
+                turn:
+
+                <a rel="nofollow" href="http://example.com/" title="a title">
+                into
+                <a href="http://example.com/" rel="nofollow noopener" title="a title">
+        '''
+        if type(self) == Markdown2TestCase and s.find('a rel="nofollow"') != -1:
+            if s.find('href="mailto:') == -1:
+                # not a mailto url
+                if 'rel="nofollow"' in s:
+                    if 'title="' in s:
+                        s = s.replace(' rel="nofollow" ', ' ').replace(' title=', ' rel="nofollow noopener" title=')
+                    else:
+                        s = s.replace(' rel="nofollow" ', ' ').replace('">', '" rel="nofollow noopener">')
+
+                return s
+            else:
+                # a mailto url
+                return s.replace(' rel="nofollow" ', ' ')
+        return s
+
+
     def test_string_markdown(self):
         p = StringHTMLProperty(self.client, 'test', '1', None, 'test', u2s(u'A string with <br> *embedded* \u00df'))
         self.assertEqual(p.markdown().strip(), u2s(u'<p>A string with &lt;br&gt; <em>embedded</em> \u00df</p>'))
@@ -437,7 +476,10 @@ def test_string_markdown_link(self):
             html_unescape = HTMLParser().unescape
 
         p = StringHTMLProperty(self.client, 'test', '1', None, 'test', u2s(u'A link <[email protected]>'))
-        self.assertEqual(html_unescape(p.markdown().strip()), u2s(u'<p>A link <a href="mailto:[email protected]">[email protected]</a></p>'))
+        m = html_unescape(p.markdown().strip())
+        m = self.mangleMarkdown2(m)
+
+        self.assertEqual(m, u2s(u'<p>A link <a href="mailto:[email protected]">[email protected]</a></p>'))
 
     def test_string_markdown_javascript_link(self):
         # make sure we don't get a "javascript:" link
@@ -457,6 +499,7 @@ def test_string_markdown_forced_line_break(self):
         # Rather than using a different result for each
         # renderer, look for '<br' and require three of them.
         m = p.markdown()
+        print(m)
         self.assertEqual(3, m.count('<br'))
 
     def test_string_markdown_code_block(self):
@@ -498,14 +541,23 @@ def test_markdown_hyperlinked_url(self):
         # so rstrip \n.
         p = StringHTMLProperty(self.client, 'test', '1', None, 'test', u2s(u'http://example.com/'))
         m = p.markdown(hyperlink=1)
-        self.assertEqual(m.rstrip('\n'), '<p><a href="http://example.com/">http://example.com/</a></p>')
+        m = self.mangleMarkdown2(m)
+        print(m)
+        self.assertEqual(m.rstrip('\n'), '<p><a href="http://example.com/" rel="nofollow noopener">http://example.com/</a></p>')
 
         p = StringHTMLProperty(self.client, 'test', '1', None, 'test', u2s(u'<http://example.com/>'))
         m = p.markdown(hyperlink=1)
-        self.assertEqual(m.rstrip('\n'), '<p><a href="http://example.com/">http://example.com/</a></p>')
+        m = self.mangleMarkdown2(m)
+        self.assertEqual(m.rstrip('\n'), '<p><a href="http://example.com/" rel="nofollow noopener">http://example.com/</a></p>')
+
+        p = StringHTMLProperty(self.client, 'test', '1', None, 'test', u2s(u'[label](http://example.com/ "a title")'))
+        m = p.markdown(hyperlink=1)
+        m = self.mangleMarkdown2(m)
+        self.assertEqual(m.rstrip('\n'), '<p><a href="http://example.com/" rel="nofollow noopener" title="a title">label</a></p>')
 
         p = StringHTMLProperty(self.client, 'test', '1', None, 'test', u2s(u'![](http://example.com/)'))
         m = p.markdown(hyperlink=1)
+        m = self.mangleMarkdown2(m)
         self.assertIn(m, [
                 '<p><img src="http://example.com/" alt=""/></p>\n',
                 '<p><img src="http://example.com/" alt="" /></p>\n',
@@ -515,11 +567,13 @@ def test_markdown_hyperlinked_url(self):
 
         p = StringHTMLProperty(self.client, 'test', '1', None, 'test', u2s(u'An URL http://example.com/ with text'))
         m = p.markdown(hyperlink=1)
-        self.assertEqual(m.rstrip('\n'), '<p>An URL <a href="http://example.com/">http://example.com/</a> with text</p>')
+        m = self.mangleMarkdown2(m)
+        self.assertEqual(m.rstrip('\n'), '<p>An URL <a href="http://example.com/" rel="nofollow noopener">http://example.com/</a> with text</p>')
 
         p = StringHTMLProperty(self.client, 'test', '1', None, 'test', u2s(u'An URL https://example.com/path with text'))
         m = p.markdown(hyperlink=1)
-        self.assertEqual(m.rstrip('\n'), '<p>An URL <a href="https://example.com/path">https://example.com/path</a> with text</p>')
+        m = self.mangleMarkdown2(m)
+        self.assertEqual(m.rstrip('\n'), '<p>An URL <a href="https://example.com/path" rel="nofollow noopener">https://example.com/path</a> with text</p>')
 
 @skip_mistune
 class MistuneTestCase(TemplatingTestCase, MarkdownTests) :