diff --git a/src/wp-includes/widgets/class-wp-widget-custom-html.php b/src/wp-includes/widgets/class-wp-widget-custom-html.php index 5d2b28a17c..93fb579e91 100644 --- a/src/wp-includes/widgets/class-wp-widget-custom-html.php +++ b/src/wp-includes/widgets/class-wp-widget-custom-html.php @@ -143,6 +143,9 @@ class WP_Widget_Custom_HTML extends WP_Widget { /** This filter is documented in wp-includes/widgets/class-wp-widget-text.php */ $content = apply_filters( 'widget_text', $instance['content'], $simulated_text_widget_instance, $this ); + // Adds noreferrer and noopener relationships, without duplicating values, to all HTML A elements that have a target. + $content = wp_targeted_link_rel( $content ); + /** * Filters the content of the Custom HTML widget. * diff --git a/src/wp-includes/widgets/class-wp-widget-text.php b/src/wp-includes/widgets/class-wp-widget-text.php index 8db1735198..ce424b49bb 100644 --- a/src/wp-includes/widgets/class-wp-widget-text.php +++ b/src/wp-includes/widgets/class-wp-widget-text.php @@ -328,6 +328,9 @@ class WP_Widget_Text extends WP_Widget { $text = preg_replace_callback( '#<(video|iframe|object|embed)\s[^>]*>#i', array( $this, 'inject_video_max_width_style' ), $text ); + // Adds noreferrer and noopener relationships, without duplicating values, to all HTML A elements that have a target. + $text = wp_targeted_link_rel( $text ); + ?>
assertContains( 'Use the Custom HTML widget to add arbitrary HTML code to your widget areas.', $help_tab['content'] ); } + + /** + * Ensure that rel="noopener noreferrer" is added to links with a target. + * + * @ticket 46421 + */ + function test_render_links_with_target() { + $widget = new WP_Widget_Custom_HTML(); + + $content = 'Test content with an external link.'; + + $args = array( + 'before_title' => '

', + 'after_title' => '

', + 'before_widget' => '', + 'after_widget' => '', + ); + + $instance = array( + 'title' => 'Foo', + 'content' => $content, + ); + + $output = get_echo( array( $widget, 'widget' ), array( $args, $instance ) ); + $this->assertContains( 'rel="noopener noreferrer"', $output ); + } + + /** + * Ensure that rel="noopener noreferrer" is not added to links without a target. + * + * @ticket 46421 + */ + function test_render_links_without_target() { + $widget = new WP_Widget_Custom_HTML(); + + $content = 'Test content with an internal link.'; + + $args = array( + 'before_title' => '

', + 'after_title' => '

', + 'before_widget' => '', + 'after_widget' => '', + ); + + $instance = array( + 'title' => 'Foo', + 'content' => $content, + ); + + $output = get_echo( array( $widget, 'widget' ), array( $args, $instance ) ); + $this->assertNotContains( 'rel="noopener noreferrer"', $output ); + } + } diff --git a/tests/phpunit/tests/widgets/text-widget.php b/tests/phpunit/tests/widgets/text-widget.php index 64146a44a3..eeb37c7ce3 100644 --- a/tests/phpunit/tests/widgets/text-widget.php +++ b/tests/phpunit/tests/widgets/text-widget.php @@ -1001,4 +1001,58 @@ class Test_WP_Widget_Text extends WP_UnitTestCase { $this->assertContains( '