Fix repeatedly adding rel values

(fixes issue #306)

Signed-off-by: Sven Strickroth <email@cs-ware.de>

Author: csware

src/main/java/org/owasp/html/HtmlPolicyBuilder.java

@@ -1038,6 +1038,7 @@ public String apply(String elementName, List<String> attrs) {
           if (relIndex < 0 && hasTarget && extra.isEmpty() && skip.isEmpty()) {
             relValue = DEFAULT_RELS_ON_TARGETTED_LINKS_STR;
           } else {
+            final Set<String> usedRels = new HashSet<>();
             StringBuilder sb = new StringBuilder();
             if (relIndex >= 0) {
               // Preserve values that are not explicitly skipped.
@@ -1046,21 +1047,23 @@ public String apply(String elementName, List<String> attrs) {
               for (int i = 0; i <= n; ++i) {
                 if (i == n || Strings.isHtmlSpace(rels.charAt(i))) {
                   if (left < i) {
-                    if (skip.isEmpty()
-                        || !skip.contains(
-                            Strings.toLowerCase(rels.substring(left, i)))) {
+                    final String rel = Strings.toLowerCase(rels.substring(left, i));
+                    if (skip.isEmpty() || !skip.contains(rel)) {
                       sb.append(rels, left, i).append(' ');
+                      usedRels.add(rel);
                     }
                   }
                   left = i + 1;
                 }
               }
             }
             for (String s : extra) {
+              if (usedRels.contains(s)) { continue; }
               sb.append(s).append(' ');
             }
             if (hasTarget) {
               for (String s : whenTargetPresent) {
+                if (usedRels.contains(s)) { continue; }
                 sb.append(s).append(' ');
               }
             }

src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java

@@ -810,7 +810,7 @@ public static final void testRelLinksWhenRelisPartOfData() {
 		        .allowStandardUrlProtocols()
 		        .toFactory();
 	  String toSanitize = "<a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://google.com\">test</a>";
-	  assertTrue("Failure in testRelLinksWhenRelisPartOfData", pf.sanitize(toSanitize).equals(toSanitize));
+	  assertEquals(toSanitize, pf.sanitize(toSanitize));
   }
 
   @Test