From de9866362e11cd883e4ae32ad25d6b440cab7dd7 Mon Sep 17 00:00:00 2001
From: Jan-Lukas Else <mail@jlelse.de>
Date: Sat, 2 May 2020 08:03:49 +0200
Subject: [PATCH] Fix external links security

---
 layouts/_default/_markup/render-link.html | 2 +-
 layouts/_default/single.html              | 2 +-
 layouts/_default/summary.html             | 2 +-
 layouts/partials/list_meta.html           | 2 +-
 layouts/partials/mentions.html            | 2 +-
 layouts/partials/post_meta.html           | 8 ++++----
 6 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/layouts/_default/_markup/render-link.html b/layouts/_default/_markup/render-link.html
index 41bdc0d..e496089 100644
--- a/layouts/_default/_markup/render-link.html
+++ b/layouts/_default/_markup/render-link.html
@@ -1 +1 @@
-<a href="{{ .Destination | safeURL }}"{{ with .Title}} title="{{ . }}"{{ end }}{{ if strings.HasPrefix .Destination "http" }} target="_blank"{{ end }}>{{ .Text | markdownify }}</a>
\ No newline at end of file
+<a href="{{ .Destination | safeURL }}"{{ with .Title}} title="{{ . }}"{{ end }}{{ if strings.HasPrefix .Destination "http" }} target="_blank" rel="noopener"{{ end }}>{{ .Text | markdownify }}</a>
\ No newline at end of file
diff --git a/layouts/_default/single.html b/layouts/_default/single.html
index f3dda39..145ca71 100644
--- a/layouts/_default/single.html
+++ b/layouts/_default/single.html
@@ -24,7 +24,7 @@
 			{{ end }}
 			{{ .Content }}
 			{{ with .Params.externalUrl }}
-			<p><a class="u-bookmark-of" href="{{ . }}" target="_blank">{{ . }}</a></p>
+			<p><a class="u-bookmark-of" href="{{ . }}" target="_blank" rel="noopener">{{ . }}</a></p>
 			{{ end }}
 		</div>
 		{{ partial "post_tags" . }}
diff --git a/layouts/_default/summary.html b/layouts/_default/summary.html
index 2e7dbff..4150aa0 100644
--- a/layouts/_default/summary.html
+++ b/layouts/_default/summary.html
@@ -3,7 +3,7 @@
 	<div class="list-header">
 		{{ if .Title }}
 		{{ if (and $showFull .Params.externalURL) }}
-		<a class="u-bookmark-of" href="{{ .Params.externalURL }}" target="_blank">
+		<a class="u-bookmark-of" href="{{ .Params.externalURL }}" target="_blank" rel="noopener">
 			<h2 class="list-title p-name">{{ .Title }}</h2>
 		</a>
 		{{ else }}
diff --git a/layouts/partials/list_meta.html b/layouts/partials/list_meta.html
index 886dccb..705ca50 100644
--- a/layouts/partials/list_meta.html
+++ b/layouts/partials/list_meta.html
@@ -1,6 +1,6 @@
 {{ if .Param "shareLink" }}
 <div class="item">
-	<a href="https://www.addtoany.com/share#url={{ .Permalink }}{{ with .Title }}&title={{ . }}{{ end }}" target="_blank" rel="nofollow noopener">{{ T "share" }}</a>
+	<a href="https://www.addtoany.com/share#url={{ .Permalink }}{{ with .Title }}&title={{ . }}{{ end }}" target="_blank" rel="nofollow noopener noreferrer">{{ T "share" }}</a>
 </div>
 {{ end }}
 {{ if .IsTranslated }}
diff --git a/layouts/partials/mentions.html b/layouts/partials/mentions.html
index 1f58525..637ffc8 100644
--- a/layouts/partials/mentions.html
+++ b/layouts/partials/mentions.html
@@ -9,7 +9,7 @@
         <ul class="mentions-list">
         {{ range sort . ".date" "asc" }}
             {{ $sourceUrl := urls.Parse .source }}
-            <li class="item"><a href="{{ .source }}" target="_blank" rel="nofollow noopener">{{ $sourceUrl.Host }}</a> <i>{{ dateFormat $dateFormat .date }}</i></li>
+            <li class="item"><a href="{{ .source }}" target="_blank" rel="nofollow noopener noreferrer">{{ $sourceUrl.Host }}</a> <i>{{ dateFormat $dateFormat .date }}</i></li>
         {{ end }}
         </ul>
     </details>
diff --git a/layouts/partials/post_meta.html b/layouts/partials/post_meta.html
index ba1e845..97469c0 100644
--- a/layouts/partials/post_meta.html
+++ b/layouts/partials/post_meta.html
@@ -16,25 +16,25 @@
 {{ with .Param "indieweb.reply" }}
 {{ if .link }}
 <div class="item">
-	{{ T "meta_reply_to" }}: <a class="u-in-reply-to" href="{{ .link }}" target="_blank">{{ .title | default .link }}</a>
+	{{ T "meta_reply_to" }}: <a class="u-in-reply-to" href="{{ .link }}" target="_blank" rel="noopener">{{ .title | default .link }}</a>
 </div>
 {{ end }}
 {{ end }}
 {{ with .Param "indieweb.like" }}
 {{ if .link }}
 <div class="item">
-	{{ T "meta_like_of" }}: <a class="u-like-of" href="{{ .link }}" target="_blank">{{ .title | default .link }}</a>
+	{{ T "meta_like_of" }}: <a class="u-like-of" href="{{ .link }}" target="_blank" rel="noopener">{{ .title | default .link }}</a>
 </div>
 {{ end }}
 {{ end }}
 {{ if .Param "shareLink" }}
 <div class="item">
-	<a href="https://www.addtoany.com/share#url={{ .Permalink }}{{ with .Title }}&title={{ . }}{{ end }}" target="_blank" rel="nofollow noopener">{{ T "share" }}</a>
+	<a href="https://www.addtoany.com/share#url={{ .Permalink }}{{ with .Title }}&title={{ . }}{{ end }}" target="_blank" rel="nofollow noopener noreferrer">{{ T "share" }}</a>
 </div>
 {{ end }}
 {{ with .Param "syndicate" }}
 <div class="item">
-	{{ T "also_on" }}:{{ $delimiter := "" }}{{ range $index, $link := . }}{{ $delimiter }} <a class="u-syndication" href="{{ $link }}" target="_blank">{{ (urls.Parse $link).Host }}</a>{{ $delimiter = "," }}{{ end }}
+	{{ T "also_on" }}:{{ $delimiter := "" }}{{ range $index, $link := . }}{{ $delimiter }} <a class="u-syndication" href="{{ $link }}" target="_blank" rel="nofollow noopener noreferrer">{{ (urls.Parse $link).Host }}</a>{{ $delimiter = "," }}{{ end }}
 </div>
 {{ end }}
 {{ if .IsTranslated }}