Fix: Gutenberg strips the rel='nofollow' in links when copying content #73872 #74288

hbhalodia · 2025-12-31T10:24:15Z

What?

Closes #73872

Why?

PR ensure that, whatever is added in rel should be kept as is on pasting when we have target="_blank", it should not strip the rel attributes.

How?

Checks if we have rel attribute, use that, else fallback to default rel value.

Testing Instructions

Open any post/page.
Paste the link you copied with rel and target blank as shown in issue Gutenberg strips the rel='nofollow' in links when copying content #73872.
Save post and check on frontend, the rel should have same value which you copied.

Testing Instructions for Keyboard

None

Screenshots or screencast

Screen.Recording.2025-12-31.at.3.52.56.PM.mov

…ult values

github-actions · 2025-12-31T10:24:26Z

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Unlinked Accounts

The following contributors have not linked their GitHub and WordPress.org accounts: @diffray-bot.

Contributors, please read how to link your accounts to ensure your work is properly credited in WordPress releases.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Unlinked contributors: diffray-bot.

Co-authored-by: hbhalodia <[email protected]>
Co-authored-by: t-hamano <[email protected]>
Co-authored-by: ellatrix <[email protected]>
Co-authored-by: BlackStar1991 <[email protected]>
Co-authored-by: alanjacobmathew <[email protected]>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

github-actions · 2025-12-31T10:24:51Z

Warning: Type of PR label mismatch

To merge this PR, it requires exactly 1 label indicating the type of PR. Other labels are optional and not being checked here.

Required label: Any label starting with [Type].
Labels found: [Package] Blocks.

Read more about Type labels in Gutenberg. Don't worry if you don't have the required permissions to add labels; the PR reviewer should be able to help with the task.

Copilot

Pull request overview

This PR fixes an issue where Gutenberg was stripping custom rel attributes (like rel="nofollow") from links when copying and pasting content with target="_blank".

Key Changes:

Modified the link processing logic to preserve existing rel attributes when target="_blank" is present
Only sets default rel="noreferrer noopener" when the rel attribute is missing or empty

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

packages/blocks/src/api/raw-handling/phrasing-content-reducer.js

…ready present

…s include noreferrer noopener when we have target as _blank

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

packages/blocks/src/api/raw-handling/test/phrasing-content-reducer.js

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

packages/blocks/src/api/raw-handling/phrasing-content-reducer.js

…s per copilot feedbacks

diffray-bot · 2025-12-31T16:12:36Z

Changes Summary

This PR fixes issue #73872 by modifying the link attribute handling in raw HTML content. When a link has target="_blank", the code now preserves existing rel attributes (like 'nofollow') while ensuring 'noreferrer' and 'noopener' are always included for security. Previously, any existing rel value would be completely replaced with only 'noreferrer noopener'.

Type: bugfix

Components Affected: Raw HTML handling - Phrasing content reducer, Link (anchor) element processing

Files Changed

File	Summary	Change	Impact
`...rc/api/raw-handling/phrasing-content-reducer.js`	Updated link handling logic to preserve existing rel attributes while guaranteeing noreferrer and noopener are present when target='_blank'	✏️	🟡
`...i/raw-handling/test/phrasing-content-reducer.js`	Added test case to verify existing rel attributes are preserved and merged with security-required attributes	✏️	🟢

Risk Areas: Security attribute handling: The logic ensures noreferrer/noopener are always present, maintaining security posture, Attribute deduplication: Uses Set to remove duplicates but filters noreferrer/noopener separately - ensure this handles all edge cases, HTML sanitization: This is part of raw HTML content handling which is security-critical in a content management system

Suggestions

Verify the regex split pattern /\s+/ handles all HTML whitespace correctly (tabs, newlines, etc.)
Consider adding test cases for edge cases: multiple spaces, tabs, duplicate rel values like 'nofollow nofollow'
Document the precedence: noreferrer/noopener are added first, then user-provided rel values - this is the intended behavior

_{Full review in progress... | Powered by diffray}

diffray-bot · 2025-12-31T16:16:23Z

packages/blocks/src/api/raw-handling/phrasing-content-reducer.js

 		// In jsdom-jscore, 'node.target' can be null.
 		// TODO: Explore fixing this by patching jsdom-jscore.
 		if ( node.target && node.target.toLowerCase() === '_blank' ) {
-			node.rel = 'noreferrer noopener';
+			const existingRels = ( node.rel || '' )
+				.split( /\s+/ )
+				.filter( Boolean );


🔴 CRITICAL - Unsafe textDecoration.includes() - undefined dereference
Agent: bugs

Category: bug

Description:
The code calls .includes() on textDecoration without checking if it's undefined. When textDecoration is not set in the style, this throws TypeError.

Suggestion:
Add a null/undefined check before calling .includes(): if (textDecorationLine === 'line-through' || (textDecoration && textDecoration.includes('line-through')))

Why this matters: Null references cause runtime crashes and unexpected behavior.

Confidence: 95%
Rule: bug_null_pointer
_{Review ID: ced57fa9-b348-43a4-a5aa-efb8247c8512}
_{Rate it 👍 or 👎 to improve future reviews | Powered by diffray}

diffray-bot · 2025-12-31T16:16:23Z

packages/blocks/src/api/raw-handling/test/phrasing-content-reducer.js

+	it( 'should preserve existing rel attribute when target is _blank', () => {
+		const input =
+			'<a href="https://wordpress.org" target="_blank" rel="nofollow noopener">WordPress</a>';
+		const output =
+			'<a href="https://wordpress.org" target="_blank" rel="noreferrer noopener nofollow">WordPress</a>';
+		expect(
+			deepFilterHTML( input, [ phrasingContentReducer ], {} )
+		).toEqual( output );
+	} );


🟡 MEDIUM - Missing test: duplicate rel values deduplication
Agent: testing

Category: quality

Description:
The code uses Array.from(new Set()) to deduplicate rel values but no test verifies this behavior.

Suggestion:
Add test case with duplicate rel values like 'nofollow nofollow' to verify deduplication works correctly.

Why this matters: New parameters without tests are a regression risk and indicate incomplete PR.

Confidence: 70%
Rule: test_new_parameter_coverage
_{Review ID: ced57fa9-b348-43a4-a5aa-efb8247c8512}
_{Rate it 👍 or 👎 to improve future reviews | Powered by diffray}

diffray-bot · 2025-12-31T16:16:24Z

Review Summary

Free public review - Want AI code reviews on your PRs? Check out diffray.ai

Validated 5 issues: 3 kept (1 critical bug, 2 test coverage), 2 filtered (low-value performance/style)

Issues Found: 3

💬 See 2 individual line comment(s) for details.

📊 2 unique issue type(s) across 3 location(s)

📋 Full issue list (click to expand)

🔴 CRITICAL - Unsafe textDecoration.includes() - undefined dereference

Agent: bugs

Category: bug

Why this matters: Null references cause runtime crashes and unexpected behavior.

File: packages/blocks/src/api/raw-handling/phrasing-content-reducer.js:46-51

Description: The code calls .includes() on textDecoration without checking if it's undefined. When textDecoration is not set in the style, this throws TypeError.

Suggestion: Add a null/undefined check before calling .includes(): if (textDecorationLine === 'line-through' || (textDecoration && textDecoration.includes('line-through')))

Confidence: 95%

Rule: bug_null_pointer

🟡 MEDIUM - Missing test: duplicate rel values deduplication (2 occurrences)

Agent: testing

Category: quality

Why this matters: New parameters without tests are a regression risk and indicate incomplete PR.

📍 View all locations

File	Description	Suggestion	Confidence
`packages/blocks/src/api/raw-handling/test/phrasing-content-reducer.js:64-72`	The code uses Array.from(new Set()) to deduplicate rel values but no test verifies this behavior.	Add test case with duplicate rel values like 'nofollow nofollow' to verify deduplication works corre...	70%
`packages/blocks/src/api/raw-handling/test/phrasing-content-reducer.js:1-91`	Test only covers single additional rel value ('nofollow'), doesn't test preserving multiple custom r...	Add test with multiple rel values like 'nofollow external sponsored' to verify all are preserved cor...	65%

Rule: test_new_parameter_coverage

ℹ️ 1 issue(s) outside PR diff (click to expand)

These issues were found in lines not modified in this PR.

🟡 MEDIUM - Missing test: multiple non-standard rel values

Agent: testing

Category: quality

Why this matters: New parameters without tests are a regression risk and indicate incomplete PR.

File: packages/blocks/src/api/raw-handling/test/phrasing-content-reducer.js:1-91

Description: Test only covers single additional rel value ('nofollow'), doesn't test preserving multiple custom rel values.

Suggestion: Add test with multiple rel values like 'nofollow external sponsored' to verify all are preserved correctly.

Confidence: 65%

Rule: test_new_parameter_coverage

_{Review ID: ced57fa9-b348-43a4-a5aa-efb8247c8512}
_{Rate it 👍 or 👎 to improve future reviews | Powered by diffray}

WordPressGH-73872 Use node.rel as is if we have else fallback to defa…

90e334f

…ult values

github-actions bot added the [Package] Blocks /packages/blocks label Dec 31, 2025

hbhalodia requested a review from Copilot December 31, 2025 10:24

Copilot started reviewing on behalf of hbhalodia December 31, 2025 10:25 View session

Copilot AI reviewed Dec 31, 2025

View reviewed changes

packages/blocks/src/api/raw-handling/phrasing-content-reducer.js Outdated Show resolved Hide resolved

hbhalodia added 2 commits December 31, 2025 16:01

WordPressGH-73872 Add the test case for updated code to use rel if al…

eb3fde0

…ready present

WordPressGH-73872 Fix integration tests to update code logic to alway…

bd2b4bb

…s include noreferrer noopener when we have target as _blank

hbhalodia requested a review from Copilot December 31, 2025 10:51

hbhalodia self-assigned this Dec 31, 2025

Copilot started reviewing on behalf of hbhalodia December 31, 2025 10:52 View session

Copilot AI reviewed Dec 31, 2025

View reviewed changes

packages/blocks/src/api/raw-handling/test/phrasing-content-reducer.js Show resolved Hide resolved

WordPressGH-73872 Update the test case as per copilot feedback

07e8156

hbhalodia requested a review from Copilot December 31, 2025 10:57

Copilot started reviewing on behalf of hbhalodia December 31, 2025 10:57 View session

Copilot AI reviewed Dec 31, 2025

View reviewed changes

packages/blocks/src/api/raw-handling/phrasing-content-reducer.js Outdated Show resolved Hide resolved

WordPressGH-73872 Update the code to remove duplicates from the rel a…

72d4e4a

…s per copilot feedbacks

diffray-bot reviewed Dec 31, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Fix: Gutenberg strips the rel='nofollow' in links when copying content #73872 #74288

Fix: Gutenberg strips the rel='nofollow' in links when copying content #73872 #74288

hbhalodia commented Dec 31, 2025

Uh oh!

github-actions bot commented Dec 31, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Dec 31, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

diffray-bot commented Dec 31, 2025

Uh oh!

diffray-bot Dec 31, 2025

Uh oh!

diffray-bot Dec 31, 2025

Uh oh!

diffray-bot commented Dec 31, 2025

🔴 CRITICAL - Unsafe textDecoration.includes() - undefined dereference

🟡 MEDIUM - Missing test: duplicate rel values deduplication (2 occurrences)

🟡 MEDIUM - Missing test: multiple non-standard rel values

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Fix: Gutenberg strips the rel='nofollow' in links when copying content #73872 #74288

Are you sure you want to change the base?

Fix: Gutenberg strips the rel='nofollow' in links when copying content #73872 #74288

Conversation

hbhalodia commented Dec 31, 2025

What?

Why?

How?

Testing Instructions

Testing Instructions for Keyboard

Screenshots or screencast

Uh oh!

github-actions bot commented Dec 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Unlinked Accounts

Uh oh!

github-actions bot commented Dec 31, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

diffray-bot commented Dec 31, 2025

Changes Summary

Uh oh!

diffray-bot Dec 31, 2025

Choose a reason for hiding this comment

Uh oh!

diffray-bot Dec 31, 2025

Choose a reason for hiding this comment

Uh oh!

diffray-bot commented Dec 31, 2025

Review Summary

Issues Found: 3

🔴 CRITICAL - Unsafe textDecoration.includes() - undefined dereference

🟡 MEDIUM - Missing test: duplicate rel values deduplication (2 occurrences)

🟡 MEDIUM - Missing test: multiple non-standard rel values

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions bot commented Dec 31, 2025 •

edited

Loading