Allow all rel values for event & post links in descriptions

Signed-off-by: Thomas Citharel <tcit@tcit.fr>

js/src/components/Editor.vue

@@ -250,7 +250,9 @@ export default class EditorComponent extends Vue {
         Mention.configure(MentionOptions),
         CustomImage,
         Underline,
-        Link,
+        Link.configure({
+          HTMLAttributes: { target: "_blank", rel: "noopener noreferrer ugc" },
+        }),
         CharacterCount.configure({
           limit: this.maxSize,
         }),

lib/service/formatter/default_scrubbler.ex

@@ -36,6 +36,11 @@ defmodule Mobilizon.Service.Formatter.DefaultScrubbler do
     "ugc"
   ])
 
+  # Rel attributes are separated by spaces
+  Meta.allow_tag_with_this_attribute_values(:a, "rel", [
+    "noopener noreferrer ugc"
+  ])
+
   Meta.allow_tag_with_these_attributes(:a, ["name", "title", "target"])
 
   Meta.allow_tag_with_these_attributes(:abbr, ["title"])