feat: add 'noreferrer' option

README.md

@@ -7,7 +7,7 @@
 
 Add nofollow attribute to all external links automatically.
 
-`hexo-filter-nofollow` add `rel="noopener external nofollow noreferrer"` to all external links for security, privacy and SEO. [Read more](https://developer.mozilla.org/en-US/docs/Web/HTML/Link_types).
+`hexo-filter-nofollow` add `rel="noopener external nofollow"` to all external links for security, privacy and SEO. [Read more](https://developer.mozilla.org/en-US/docs/Web/HTML/Link_types).
 
 ## Installations
 
@@ -24,6 +24,7 @@ nofollow:
   exclude:
     - 'exclude1.com'
     - 'exclude2.com'
+  noreferrer: false
 ```
 
 - **enable** - Enable the plugin. Default value is `true`.
@@ -32,3 +33,5 @@ nofollow:
   - 'site' - Add nofollow attribute to external links of whole sites
 - **exclude** - Exclude hostname. Specify subdomain when applicable, including `www`.
   - 'exclude1.com' does not apply to `www.exclude1.com` nor `en.exclude1.com`.
+- **noreferrer** - Add noreferrer to `rel` attribute. Prevents browser from sending [referer](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referer) to external links.
+  - Disabling this option (default) does not remove existing `noreferrer` value.

index.js

@@ -5,7 +5,8 @@
 hexo.config.nofollow = Object.assign({
   enable: true,
   field: 'site',
-  exclude: []
+  exclude: [],
+  noreferrer: false
 }, hexo.config.nofollow);
 
 const config = hexo.config.nofollow;

lib/filter.js

@@ -24,8 +24,9 @@ function isExternal(url, config) {
 module.exports = function(data) {
   const hexo = this;
   const config = hexo.config;
+  const { exclude: excludeCfg, field, noreferrer } = config.nofollow;
 
-  const exclude = config.nofollow.exclude;
+  const exclude = excludeCfg;
   if (exclude && !Array.isArray(exclude)) {
     config.nofollow.exclude = [exclude];
   }
@@ -34,7 +35,9 @@ module.exports = function(data) {
     return data.replace(/<a.*?(href=['"](.*?)['"]).*?>/gi, (str, hrefStr, href) => {
       if (!isExternal(href, config)) return str;
 
-      let noFollow = ['noopener', 'external', 'nofollow', 'noreferrer'];
+      let noFollow = !noreferrer
+        ? ['noopener', 'external', 'nofollow']
+        : ['noopener', 'external', 'nofollow', 'noreferrer'];
 
       if (/rel=/gi.test(str)) {
         str = str.replace(/\srel="(.*?)"/gi, (relStr, rel) => {
@@ -51,7 +54,7 @@ module.exports = function(data) {
     });
   };
 
-  if (config.nofollow.field === 'post') {
+  if (field === 'post') {
     data.content = filterExternal(data.content);
   } else {
     data = filterExternal(data);

package.json

@@ -36,6 +36,7 @@
     "eslint": "^7.5.0",
     "eslint-config-hexo": "^4.1.0",
     "hexo": "hexojs/hexo",
+    "hexo-util": "^2.2.0",
     "mocha": "^8.0.1"
   }
 }

test/index.js

@@ -1,15 +1,26 @@
 'use strict';
 
 require('chai').should();
+const Hexo = require('hexo');
+const { deepMerge } = require('hexo-util');
 
 describe('hexo-filter-nofollow', () => {
-  const Hexo = require('hexo');
   const hexo = new Hexo();
-
   const nofollowFilter = require('../lib/filter').bind(hexo);
 
   hexo.config.url = 'https://example.com';
-  hexo.config.nofollow = {};
+  const defaultCfg = deepMerge(hexo.config, {
+    nofollow: {
+      enable: true,
+      field: 'site',
+      exclude: [],
+      noreferrer: false
+    }
+  });
+
+  beforeEach(() => {
+    hexo.config = deepMerge({}, defaultCfg);
+  });
 
   describe('Default', () => {
     const content = [
@@ -36,18 +47,18 @@ describe('hexo-filter-nofollow', () => {
     const expected = [
       '# External link test',
       '1. External link',
-      '<a href="https://hexo.io/" rel="noopener external nofollow noreferrer">Hexo</a>',
+      '<a href="https://hexo.io/" rel="noopener external nofollow">Hexo</a>',
       '2. External link with existed "rel" Attribute',
-      '<a href="https://github.com/hexojs/hexo-filter-nofollow/blob/master/LICENSE" rel="noopener external nofollow noreferrer license">Hexo</a>',
-      '<a href="https://github.com/hexojs/hexo-filter-nofollow/blob/master/LICENSE" rel="noopener external nofollow noreferrer license">Hexo</a>',
+      '<a href="https://github.com/hexojs/hexo-filter-nofollow/blob/master/LICENSE" rel="noopener external nofollow license">Hexo</a>',
+      '<a href="https://github.com/hexojs/hexo-filter-nofollow/blob/master/LICENSE" rel="noopener external nofollow license">Hexo</a>',
       '3. External link with existing "rel=noopener", "rel=external" or "rel=noreferrer"',
-      '<a href="https://hexo.io/" rel="noopener external nofollow noreferrer">Hexo</a>',
+      '<a href="https://hexo.io/" rel="noopener external nofollow">Hexo</a>',
       '<a href="https://hexo.io/" rel="noopener external nofollow noreferrer">Hexo</a>',
       '<a href="https://hexo.io/" rel="noopener external nofollow noreferrer">Hexo</a>',
       '<a href="https://hexo.io/" rel="noopener external nofollow noreferrer">Hexo</a>',
       '4. External link with Other Attributes',
-      '<a class="img" href="https://hexo.io/" rel="noopener external nofollow noreferrer">Hexo</a>',
-      '<a href="https://hexo.io/" rel="noopener external nofollow noreferrer" class="img">Hexo</a>',
+      '<a class="img" href="https://hexo.io/" rel="noopener external nofollow">Hexo</a>',
+      '<a href="https://hexo.io/" rel="noopener external nofollow" class="img">Hexo</a>',
       '5. Internal link',
       '<a href="/archives/foo.html">Link</a>',
       '6. Ignore links don\'t have "href" attribute',
@@ -92,12 +103,12 @@ describe('hexo-filter-nofollow', () => {
       result.should.eql([
         '# Exclude link test',
         '1. External link',
-        '<a href="https://hexo.io/" rel="noopener external nofollow noreferrer">Hexo</a>',
+        '<a href="https://hexo.io/" rel="noopener external nofollow">Hexo</a>',
         '2. Ignore links whose hostname is same as config',
         '<a href="https://example.com">Example Domain</a>',
         '3. Ignore links whose hostname is included in exclude',
         '<a href="https://example.org">Example Domain</a>',
-        '<a href="https://test.example.org" rel="noopener external nofollow noreferrer">Example Domain</a>'
+        '<a href="https://test.example.org" rel="noopener external nofollow">Example Domain</a>'
       ].join('\n'));
     });
 
@@ -109,7 +120,7 @@ describe('hexo-filter-nofollow', () => {
       result.should.eql([
         '# Exclude link test',
         '1. External link',
-        '<a href="https://hexo.io/" rel="noopener external nofollow noreferrer">Hexo</a>',
+        '<a href="https://hexo.io/" rel="noopener external nofollow">Hexo</a>',
         '2. Ignore links whose hostname is same as config',
         '<a href="https://example.com">Example Domain</a>',
         '3. Ignore links whose hostname is included in exclude',
@@ -118,4 +129,26 @@ describe('hexo-filter-nofollow', () => {
       ].join('\n'));
     });
   });
+
+  describe('noreferrer', () => {
+    it('Default', () => {
+      const result = nofollowFilter('<a href="https://hexo.io/">Hexo</a>');
+
+      result.should.eql('<a href="https://hexo.io/" rel="noopener external nofollow">Hexo</a>');
+    });
+
+    it('Retain original noreferrer', () => {
+      const result = nofollowFilter('<a href="https://hexo.io/" rel="noreferrer">Hexo</a>');
+
+      result.should.eql('<a href="https://hexo.io/" rel="noopener external nofollow noreferrer">Hexo</a>');
+    });
+
+    it('Enable', () => {
+      hexo.config.nofollow.noreferrer = true;
+      const result = nofollowFilter('<a href="https://hexo.io/">Hexo</a>');
+
+      result.should.eql('<a href="https://hexo.io/" rel="noopener external nofollow noreferrer">Hexo</a>');
+    });
+
+  });
 });