@gitlab/ui/dist/directives/safe_link/safe_link.js

GitLab UI Components

import Vue from 'vue';

var getBaseURL = function getBaseURL() {
  var _window$location = window.location,
      protocol = _window$location.protocol,
      host = _window$location.host;
  return "".concat(protocol, "//").concat(host);
};

var isExternalURL = function isExternalURL(target, hostname) {
  return target === '_blank' && hostname !== window.location.hostname;
};

var secureRel = function secureRel(rel) {
  var rels = rel ? rel.trim().split(' ') : [];

  if (!rels.includes('noopener')) {
    rels.push('noopener');
  }

  if (!rels.includes('noreferrer')) {
    rels.push('noreferrer');
  }

  return rels.join(' ');
};

var isSafeURL = function isSafeURL(url) {
  try {
    var parsedURL = new URL(url, getBaseURL());
    return ['http:', 'https:', 'mailto:', 'ftp:'].includes(parsedURL.protocol);
  } catch (e) {
    return false;
  }
};

var transform = function transform(el) {
  var href = el.href,
      target = el.target,
      rel = el.rel,
      hostname = el.hostname;

  if (!isSafeURL(href)) {
    el.href = 'about:blank';
  }

  if (isExternalURL(target, hostname)) {
    el.rel = secureRel(rel);
  }
};

var SafeLinkDirective = {
  inserted: transform,
  update: function update(el) {
    Vue.nextTick(function () {
      transform(el);
    });
  }
};

export default SafeLinkDirective;