diff --git a/src/Renderers/SpanNodeRenderer.php b/src/Renderers/SpanNodeRenderer.php
index 0fc9f9c..2510e82 100644
--- a/src/Renderers/SpanNodeRenderer.php
+++ b/src/Renderers/SpanNodeRenderer.php
@@ -52,6 +52,11 @@ public function link(?string $url, string $title, array $attributes = []): strin
$this->urlChecker->checkUrl($url);
}
+ if (!$this->isSafeUrl($url)) {
+ $attributes['rel'] = 'external noopener noreferrer';
+ $attributes['target'] = '_blank';
+ }
+
return $this->templateRenderer->render(
'link.html.twig',
[
@@ -80,4 +85,20 @@ private function isExternalUrl($url): bool
{
return u($url)->containsAny('://');
}
+
+ /*
+ * If the URL is considered safe, it's opened in the same browser tab;
+ * otherwise it's opened in a new tab and with some strict security options.
+ */
+ private function isSafeUrl(string $url): bool
+ {
+ // The following are considered Symfony URLs:
+ // * https://symfony.com/[...]
+ // * https://[...].symfony.com/ (e.g. insight.symfony.com, etc.)
+ // * https://symfony.wip/[...] (used for internal/local development)
+ $isSymfonyUrl = preg_match('{^http(s)?://(.*\.)?symfony.(com|wip)}', $url);
+ $isRelativeUrl = !str_starts_with($url, 'http://') && !str_starts_with($url, 'https://');
+
+ return $isSymfonyUrl || $isRelativeUrl;
+ }
}
diff --git a/tests/fixtures/expected/blocks/references/php-class.html b/tests/fixtures/expected/blocks/references/php-class.html
index de4cdbc..dc8c36f 100644
--- a/tests/fixtures/expected/blocks/references/php-class.html
+++ b/tests/fixtures/expected/blocks/references/php-class.html
@@ -3,11 +3,11 @@
-
+
- ArrayAccess
+ ArrayAccess
-