Merge pull request #3131 from AndrewKvalheim/nofollow

Set `nofollow` on user-generated links
2023-04-19 13:19:34 +02:00 · 2023-04-19 13:19:34 +02:00 · 8b909a95c9
commit 8b909a95c9
parent 3aaf86076f 80d7ac545c
2 changed files with 14 additions and 1 deletions
--- a/app/helpers/format_helper.rb
+++ b/app/helpers/format_helper.rb
@ -202,7 +202,7 @@ module FormatHelper
      safe_links_only: true
    }
    markdown = Redcarpet::Markdown.new(Redcarpet::Render::HTML.new(render_options), markdown_options)
-    sanitize(markdown.render(text))
+    sanitize(sanitize(markdown.render(text)), scrubber: Loofah::Scrubbers::NoFollow.new)
  end

  def markdown_hint(text='')