Add ExternalLinkFilter to Markdown pipeliners-dont-follow-me

Forces a `rel="nofollow"` attribute on all external links.

2 files changed, 35 insertions, 0 deletions

diff --git a/lib/gitlab/markdown.rb b/lib/gitlab/markdown.rb
index c0fb22e7f36..5db1566f55d 100644
--- a/lib/gitlab/markdown.rb
+++ b/lib/gitlab/markdown.rb
@@ -11,6 +11,7 @@ module Gitlab
     autoload :CommitReferenceFilter,        'gitlab/markdown/commit_reference_filter'
     autoload :EmojiFilter,                  'gitlab/markdown/emoji_filter'
     autoload :ExternalIssueReferenceFilter, 'gitlab/markdown/external_issue_reference_filter'
+    autoload :ExternalLinkFilter,           'gitlab/markdown/external_link_filter'
     autoload :IssueReferenceFilter,         'gitlab/markdown/issue_reference_filter'
     autoload :LabelReferenceFilter,         'gitlab/markdown/label_reference_filter'
     autoload :MergeRequestReferenceFilter,  'gitlab/markdown/merge_request_reference_filter'
@@ -103,6 +104,7 @@ module Gitlab
         Gitlab::Markdown::EmojiFilter,
         Gitlab::Markdown::TableOfContentsFilter,
         Gitlab::Markdown::AutolinkFilter,
+        Gitlab::Markdown::ExternalLinkFilter,
 
         Gitlab::Markdown::UserReferenceFilter,
         Gitlab::Markdown::IssueReferenceFilter,
diff --git a/lib/gitlab/markdown/external_link_filter.rb b/lib/gitlab/markdown/external_link_filter.rb
new file mode 100644
index 00000000000..c539e0fb823
--- /dev/null
+++ b/lib/gitlab/markdown/external_link_filter.rb
@@ -0,0 +1,33 @@
+require 'html/pipeline/filter'
+
+module Gitlab
+  module Markdown
+    # HTML Filter to add a `rel="nofollow"` attribute to external links
+    #
+    class ExternalLinkFilter < HTML::Pipeline::Filter
+      def call
+        doc.search('a').each do |node|
+          next unless node.has_attribute?('href')
+
+          link = node.attribute('href').value
+
+          # Skip non-HTTP(S) links
+          next unless link.start_with?('http')
+
+          # Skip internal links
+          next if link.start_with?(internal_url)
+
+          node.set_attribute('rel', 'nofollow')
+        end
+
+        doc
+      end
+
+      private
+
+      def internal_url
+        @internal_url ||= Gitlab.config.gitlab.url
+      end
+    end
+  end
+end