From 29417005b0527b62fa5654592419f50ba40324d4 Mon Sep 17 00:00:00 2001
From: Ebrahim Byagowi <ebrahim@gnu.org>
Date: Tue, 22 Mar 2016 20:09:12 +0430
Subject: [PATCH] Add rel="noreferrer" to resolve window.opener issue

https://mathiasbynens.github.io/rel-noopener
---
 src/main/app/templates/feeds.view.html                  | 4 ++--
 src/main/java/com/commafeed/backend/feed/FeedUtils.java | 1 +
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/main/app/templates/feeds.view.html b/src/main/app/templates/feeds.view.html
index 132da0ba..b8e5b3f5 100644
--- a/src/main/app/templates/feeds.view.html
+++ b/src/main/app/templates/feeds.view.html
@@ -6,7 +6,7 @@
 				<span ng-switch-when="starred">{{ 'tree.starred' | translate }}</span>
 				<span ng-switch-default>
 					<span ng-hide="feedLink">{{name}}</span>
-					<a ng-show="feedLink" href="{{feedLink}}" target="_blank">{{name}}</a>
+					<a ng-show="feedLink" href="{{feedLink}}" target="_blank" rel="noreferrer">{{name}}</a>
 				</span>
 			</span>
 			<span ng-show="name"> &#187;</span>
@@ -20,7 +20,7 @@
 		<div ng-repeat="entry in entries" class="entry entry-font-size-{{font_size}}" id="entry_{{entry.id}}"
 			ng-class="{unread: entry.read == false, current: current==entry, open: isOpen, closed: !isOpen }">
 			<div class="entry-heading" ng-swipe-right="mark(entry, !entry.read)">
-				<a href="{{entry.url}}" target="_blank" class="entry-heading-link" ng-click="noop($event)" ng-mouseup="entryClicked(entry, $event)">
+				<a href="{{entry.url}}" target="_blank" rel="noreferrer" class="entry-heading-link" ng-click="noop($event)" ng-mouseup="entryClicked(entry, $event)">
 					<span class="feed-name">
 						<span class="star" ng-mouseup="star(entry, !entry.starred, $event)">
 							<i ng-class="{'icon-star icon-star-yellow': entry.starred, 'icon-star-empty': !entry.starred}" class="pointer"></i>
diff --git a/src/main/java/com/commafeed/backend/feed/FeedUtils.java b/src/main/java/com/commafeed/backend/feed/FeedUtils.java
index 5c9e3369..e0e90c52 100644
--- a/src/main/java/com/commafeed/backend/feed/FeedUtils.java
+++ b/src/main/java/com/commafeed/backend/feed/FeedUtils.java
@@ -92,6 +92,7 @@ public class FeedUtils {
 		whitelist.addProtocols("q", "cite", "http", "https");
 
 		whitelist.addEnforcedAttribute("a", "target", "_blank");
+		whitelist.addEnforcedAttribute("a", "rel", "noreferrer");
 		return whitelist;
 	}