feat: add 'ugc' to link rel attributes#3531
Conversation
|
https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Attributes/rel 看起来好像不是 Web 标准，只是 Google 推荐的配置？并没有在 MDN 上有看到相关的定义描述。 https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Attributes/rel Doesn’t look like it’s a web standard, just a configuration recommended by Google? I haven't seen any relevant definition description on MDN. |
There was a problem hiding this comment.
Pull request overview
This PR updates outbound link rel attributes to include ugc, aligning link semantics with Google’s guidance for user-generated content links.
Changes:
- Update the server-side DOMPurify hook to set
rel="ugc nofollow noreferrer noopener"on sanitized links. - Update XSS/link sanitization tests to reflect the new
relvalue. - Update the client
CommentCardauthor link to includeugcin itsrelattribute.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| packages/server/src/service/markdown/xss.js | Adds ugc to the enforced rel attribute for sanitized links. |
| packages/server/tests/xss.spec.js | Updates link resolution expectations to match the new rel string. |
| packages/client/src/components/CommentCard.vue | Adds ugc to the rel attribute for user profile links opened in a new tab. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
显然 mdn 声明：此表仅包含最重要（most important）的部分。 
mdn 声明的三个来源中，第一个 https://www.iana.org/assignments/link-relations/link-relations.xhtml 就包括 ugc 值。 
|
fix #214 - `+ ugc` 符合最新语义（Google 自 2019） 我调查了下其他的 - twikoo 是 noopener noreferrer nofollow ugc twikoojs/twikoo#907 - waline 是 ugc nofollow noopener noreferrer walinejs/waline#3531 - artalk 是 noreferrer noopener nofollow ArtalkJS/Artalk#1120 - valine 是 noopener 相关文档： - nofollow 和 ugc 一起用以保证兼容性：https://developers.google.com/search/blog/2019/09/evolving-nofollow-new-ways-to-identify?hl=zh-cn#can-i-use-more-than-one-rel-value-on-a-link - 几个用于出站链接的 rel 值（sponsored，ugc，nofollow）介绍：https://developers.google.com/search/docs/crawling-indexing/qualify-outbound-links?hl=zh-cn --- 没有把链接的 target / rel 处理放进 packages/comment-widget/src/utils/html.ts 的 cleanHtml()，而是放在了渲染期 packages/comment-widget/src/comment-content.ts。 给评论正文里的 <a> 统一补 target="_blank" 和 rel="noopener noreferrer nofollow ugc" 作为渲染策略，区分于清洗逻辑。如果要在清洗的时候就做这个 rel 修改，有以下问题： - 首先数据库要额外保存 rel，要修改默认 sanitize-html 策略（附：sanitize-html 默认给 a 允许的是：href、name、target。） - 之前数据不带 rel 的已有数据，在渲染时也不能自带加上新 rel。
+ ugc符合最新语义（Google 自 2019）我调查了下其他的
相关文档：
+ugcconforms to the latest semantics (Google since 2019)I looked into other
Related documents: