open markdown links in new tab (take 2) (#512)

* open links in chats in new tabs

* fixed target_blank vulnerability

* add test to make sur links are being generated with target _blank

* add test for target blank vulnerability

* add rel and target to the whitelisted attributes

* add the link attributes to HTMLRouge#link

app/labor/markdown_parser.rb

@@ -37,12 +37,12 @@ class MarkdownParser
     renderer_options = {
       hard_wrap: true,
       filter_html: false,
-      link_attributes: { rel: 'noopener noreferrer', target: "_blank" },
+      link_attributes: { rel: "noopener noreferrer", target: "_blank" },
     }
     renderer = Redcarpet::Render::HTMLRouge.new(renderer_options)
     markdown = Redcarpet::Markdown.new(renderer, REDCARPET_CONFIG)
     ActionController::Base.helpers.sanitize(markdown.render(@content).html_safe,
-      tags: %w(strong i u b em code a), attributes: ["href"])
+      tags: %w(strong i u b em code a), attributes: %w(href rel target))
   end
 
   def tags_used

app/lib/redcarpet/render/html_rouge.rb

@@ -9,7 +9,11 @@ module Redcarpet
         # Probably not the best fix but it does it's job of preventing
         # a nested links.
         return nil if /<a\s.+\/a>/.match?(content)
-        %(<a href="#{link}">#{content}</a>)
+        link_attributes = ""
+        @options[:link_attributes]&.each do |attribute, value|
+          link_attributes += %( #{attribute}="#{value}")
+        end
+        %(<a href="#{link}"#{link_attributes}>#{content}</a>)
       end
     end
   end

spec/labor/markdown_parser_spec.rb

@@ -22,6 +22,19 @@ RSpec.describe MarkdownParser do
     expect(generate_and_parse_markdown(inline_code)).to include(inline_code[1..-2])
   end
 
+  context "when provided with a link in inline code" do
+    inline_code = "[dev.to](https://dev.to)"
+    let(:evaluated_markdown) { described_class.new(inline_code).evaluate_inline_markdown }
+
+    it "renders with target _blank" do
+      expect(evaluated_markdown).to include("target=\"_blank\"")
+    end
+
+    it "avoids the traget _blank vulnerability" do
+      expect(evaluated_markdown).to include("noopener", "noreferrer")
+    end
+  end
+
   context "when provided with an @username" do
     it "links to a user if user exist" do
       username = create(:user).username