From 80d7ac545c132d469711a0a027041d0f04a781ca Mon Sep 17 00:00:00 2001 From: Andrew Kvalheim Date: Fri, 3 Mar 2023 16:51:01 -0800 Subject: [PATCH] Set nofollow on links in Markdown content To disincentivize spamdexing, links in user-generated content should be disavowed by annotation with `rel="nofollow"` attributes: - https://en.wikipedia.org/wiki/Nofollow Automated spam has already targeted OSEM in the wild: - https://github.com/SeaGL/organization/issues/274 Ideally link annotation would be performed during Markdown rendering or a single sanitization pass, but this is currently an unresolved issue: - https://github.com/vmg/redcarpet/issues/720 --- app/helpers/format_helper.rb | 2 +- spec/helpers/format_helper_spec.rb | 5 +++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/app/helpers/format_helper.rb b/app/helpers/format_helper.rb index 26014f89..152ac239 100644 --- a/app/helpers/format_helper.rb +++ b/app/helpers/format_helper.rb @@ -202,7 +202,7 @@ module FormatHelper safe_links_only: true } markdown = Redcarpet::Markdown.new(Redcarpet::Render::HTML.new(render_options), markdown_options) - sanitize(markdown.render(text)) + sanitize(sanitize(markdown.render(text)), scrubber: Loofah::Scrubbers::NoFollow.new) end def markdown_hint(text='') diff --git a/spec/helpers/format_helper_spec.rb b/spec/helpers/format_helper_spec.rb index 31adf107..e4190d09 100644 --- a/spec/helpers/format_helper_spec.rb +++ b/spec/helpers/format_helper_spec.rb @@ -24,5 +24,10 @@ describe FormatHelper, type: :helper do it 'removes unallowed elements' do expect(markdown('**', false)).to eq "

a

\n" end + + it 'sets nofollow on links' do + expect(markdown('[a](https://example.com/)')) + .to eq "

a

\n" + end end end