From b75b6de982013fdfd08b8aecb1c701b35c787599 Mon Sep 17 00:00:00 2001
From: Arpit Jalan <arpit@techapj.com>
Date: Mon, 26 Mar 2018 15:54:39 +0530
Subject: [PATCH] FIX: respect nofollow settings for onebox links

---
 lib/cooked_post_processor.rb                  |  4 ++++
 lib/pretty_text.rb                            |  1 +
 spec/components/cooked_post_processor_spec.rb | 18 ++++++++++++++++++
 3 files changed, 23 insertions(+)

diff --git a/lib/cooked_post_processor.rb b/lib/cooked_post_processor.rb
index 05d5924753e..4b8aa8c5f7a 100644
--- a/lib/cooked_post_processor.rb
+++ b/lib/cooked_post_processor.rb
@@ -454,6 +454,10 @@ class CookedPostProcessor
         img.parent["style"] = "--aspect-ratio:#{width}/#{height};"
       end
     end
+
+    if @cooking_options[:omit_nofollow] || !SiteSetting.add_rel_nofollow_to_user_content
+      @doc.css(".onebox-body a, .onebox a").each { |a| a.remove_attribute("rel") }
+    end
   end
 
   def optimize_urls
diff --git a/lib/pretty_text.rb b/lib/pretty_text.rb
index 0e838279712..4e2fc4e81e3 100644
--- a/lib/pretty_text.rb
+++ b/lib/pretty_text.rb
@@ -273,6 +273,7 @@ module PrettyText
            uri.host.ends_with?("." << site_uri.host) ||
            whitelist.any? { |u| uri.host == u || uri.host.ends_with?("." << u) }
           # we are good no need for nofollow
+          l.remove_attribute("rel")
         else
           l["rel"] = "nofollow noopener"
         end
diff --git a/spec/components/cooked_post_processor_spec.rb b/spec/components/cooked_post_processor_spec.rb
index 2f60a6e46f8..103bbc4f799 100644
--- a/spec/components/cooked_post_processor_spec.rb
+++ b/spec/components/cooked_post_processor_spec.rb
@@ -490,6 +490,24 @@ describe CookedPostProcessor do
     end
   end
 
+  context ".post_process_oneboxes removes nofollow if add_rel_nofollow_to_user_content is disabled" do
+    let(:post) { build(:post_with_youtube, id: 123) }
+    let(:cpp) { CookedPostProcessor.new(post, invalidate_oneboxes: true) }
+
+    before do
+      SiteSetting.add_rel_nofollow_to_user_content = false
+      Oneboxer.expects(:onebox)
+        .with("http://www.youtube.com/watch?v=9bZkp7q19f0", invalidate_oneboxes: true, user_id: nil, category_id: post.topic.category_id)
+        .returns('<aside class="onebox"><a href="https://www.youtube.com/watch?v=9bZkp7q19f0" rel="nofollow noopener">GANGNAM STYLE</a></aside>')
+      cpp.post_process_oneboxes
+    end
+
+    it "removes nofollow noopener from links" do
+      expect(cpp).to be_dirty
+      expect(cpp.html).to match_html '<aside class="onebox"><a href="https://www.youtube.com/watch?v=9bZkp7q19f0">GANGNAM STYLE</a></aside>'
+    end
+  end
+
   context ".post_process_oneboxes with square image" do
 
     it "generates a onebox-avatar class" do