From b0eeb8a20750d288b5bad6471a3e6ee0c3a010c2 Mon Sep 17 00:00:00 2001
From: Boris Grozev <boris@jitsi.org>
Date: Wed, 5 Jul 2017 15:15:10 -0500
Subject: [PATCH] fix: Avoid tabnabbing

Reported by Manav.
---
 modules/UI/side_pannels/chat/Replacement.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/UI/side_pannels/chat/Replacement.js b/modules/UI/side_pannels/chat/Replacement.js
index a4b00559a..fb16d4702 100644
--- a/modules/UI/side_pannels/chat/Replacement.js
+++ b/modules/UI/side_pannels/chat/Replacement.js
@@ -23,11 +23,11 @@ export function linkify(inputText) {
 
     //URLs starting with http://, https://, or ftp://
     replacePattern1 = /(\b(https?|ftp):\/\/[-A-Z0-9+&@#\/%?=~_|!:,.;]*[-A-Z0-9+&@#\/%=~_|])/gim;
-    replacedText = inputText.replace(replacePattern1, '<a href="$1" target="_blank">$1</a>');
+    replacedText = inputText.replace(replacePattern1, '<a href="$1" target="_blank" rel="noopener noreferrer">$1</a>');
 
     //URLs starting with "www." (without // before it, or it'd re-link the ones done above).
     replacePattern2 = /(^|[^\/])(www\.[\S]+(\b|$))/gim;
-    replacedText = replacedText.replace(replacePattern2, '$1<a href="http://$2" target="_blank">$2</a>');
+    replacedText = replacedText.replace(replacePattern2, '$1<a href="http://$2" target="_blank" rel="noopener noreferrer">$2</a>');
 
     //Change email addresses to mailto: links.
     replacePattern3 = /(([a-zA-Z0-9\-\_\.])+@[a-zA-Z\_]+?(\.[a-zA-Z]{2,6})+)/gim;