Don't allow duplicates in rel attribute for links

Signed-off-by: Sven Strickroth <email@cs-ware.de>

Author: csware

src/main/java/org/owasp/html/HtmlPolicyBuilder.java

@@ -1048,7 +1048,7 @@ public String apply(String elementName, List<String> attrs) {
                 if (i == n || Strings.isHtmlSpace(rels.charAt(i))) {
                   if (left < i) {
                     final String rel = Strings.toLowerCase(rels.substring(left, i));
-                    if (skip.isEmpty() || !skip.contains(rel)) {
+                    if ((skip.isEmpty() || !skip.contains(rel)) && !usedRels.contains(rel)) {
                       sb.append(rels, left, i).append(' ');
                       usedRels.add(rel);
                     }

src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java

@@ -813,6 +813,31 @@ public static final void testRelLinksWhenRelisPartOfData() {
 	  assertEquals(toSanitize, pf.sanitize(toSanitize));
   }
 
+  @Test
+  public static final void testRelLinksWithDuplicateRels() {
+    PolicyFactory pf = new HtmlPolicyBuilder()
+        .allowElements("a")
+        .allowAttributes("href").onElements("a")
+        .allowAttributes("rel").onElements("a")
+        .allowAttributes("target").onElements("a")
+        .allowStandardUrlProtocols()
+        .toFactory();
+    assertEquals("<a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://google.com\">test</a>", pf.sanitize("<a target=\"_blank\" rel=\"noopener noreferrer noreferrer\" href=\"https://google.com\">test</a>"));
+  }
+
+  @Test
+  public static final void testRelLinksWithDuplicateRelsRequired() {
+    PolicyFactory pf = new HtmlPolicyBuilder()
+        .allowElements("a")
+        .allowAttributes("href").onElements("a")
+        .allowAttributes("rel").onElements("a")
+        .allowAttributes("target").onElements("a")
+        .allowStandardUrlProtocols()
+        .requireRelsOnLinks("noreferrer")
+        .toFactory();
+    assertEquals("<a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://google.com\">test</a>", pf.sanitize("<a target=\"_blank\" rel=\"noopener noreferrer noreferrer\" href=\"https://google.com\">test</a>"));
+  }
+
   @Test
   public static final void testFailFastOnSpaceSeparatedStrings() {
     boolean failed;