Description: Remove XSS from the link modal
 Editor: Prevent adding javascript: and data: URLs through the inline
 link dialog.
 CVE-2017-14718
 Previous changeset 41401
Author: ocean90@wordpress.org
Origin: upstream, https://core.trac.wordpress.org/changeset/41407/branches/4.1
Bug-Debian: https://bugs.debian.org/876274
Applied-Upstream: 4.8.2
Reviewed-by: Craig Small <csmall@debian.org>
Last-Update: 2017-10-10
--- a/wp-includes/js/wplink.js
+++ b/wp-includes/js/wplink.js
@@ -210,6 +210,13 @@
 
 			attrs = wpLink.getAttrs();
 
+			var parser = document.createElement( 'a' );
+			parser.href = attrs.href;
+
+			if ( 'javascript:' === parser.protocol || 'data:' === parser.protocol ) { // jshint ignore:line
+				attrs.href = '';
+			}
+
 			// If there's no href, return.
 			if ( ! attrs.href || attrs.href == 'http://' )
 				return;
@@ -223,7 +230,7 @@
 			}
 
 			if ( attrs.target ) {
-				html += ' target="' + attrs.target + '"';
+				html += ' rel="noopener" target="' + attrs.target + '"';
 			}
 
 			html += '>';
@@ -275,6 +282,13 @@
 
 			link = editor.dom.getParent( editor.selection.getNode(), 'a[href]' );
 
+			var parser = document.createElement( 'a' );
+			parser.href = attrs.href;
+
+			if ( 'javascript:' === parser.protocol || 'data:' === parser.protocol ) { // jshint ignore:line
+				attrs.href = '';
+			}
+
 			// If the values are empty, unlink and return
 			if ( ! attrs.href || attrs.href == 'http://' ) {
 				editor.execCommand( 'unlink' );
