From 568e5be7dc8f9f868d1c693b95721e6be80bdcb6 Mon Sep 17 00:00:00 2001
From: Marcel Werk <burntime@woltlab.com>
Date: Thu, 6 Aug 2020 23:19:27 +0200
Subject: [PATCH] Add rel="ugc" for links within user generated content

---
 com.woltlab.wcf/templates/quoteMetaCode.tpl   |  2 +-
 .../templates/userInformationButtons.tpl      |  2 +-
 .../article/content/ArticleContent.class.php  |  5 ++++
 .../lib/data/box/content/BoxContent.class.php |  1 +
 .../data/custom/option/CustomOption.class.php |  2 +-
 .../data/page/content/PageContent.class.php   |  1 +
 .../lib/system/bbcode/MediaBBCode.class.php   |  4 ++--
 .../bbcode/SimpleMessageParser.class.php      |  2 +-
 .../html/output/HtmlOutputProcessor.class.php | 24 +++++++++++++++++++
 .../output/node/HtmlOutputNodeA.class.php     | 10 ++++++--
 .../output/node/HtmlOutputNodeImg.class.php   | 11 +++++----
 .../user/FacebookUserOptionOutput.class.php   |  2 +-
 .../user/TwitterUserOptionOutput.class.php    |  2 +-
 .../option/user/URLUserOptionOutput.class.php |  2 +-
 ...AttributesFunctionTemplatePlugin.class.php |  5 ++++
 .../files/lib/util/StringUtil.class.php       | 11 ++++++---
 16 files changed, 68 insertions(+), 18 deletions(-)

diff --git a/com.woltlab.wcf/templates/quoteMetaCode.tpl b/com.woltlab.wcf/templates/quoteMetaCode.tpl
index ebbfe33476..b9a0fc49e0 100644
--- a/com.woltlab.wcf/templates/quoteMetaCode.tpl
+++ b/com.woltlab.wcf/templates/quoteMetaCode.tpl
@@ -11,7 +11,7 @@
 		<span class="quoteBoxTitle">
 			{if $quoteAuthor}
 				{if $quoteLink}
-					<a {anchorAttributes url=$quoteLink}>{lang}wcf.bbcode.quote.title{/lang}</a>
+					<a {anchorAttributes url=$quoteLink isUgc=true}>{lang}wcf.bbcode.quote.title{/lang}</a>
 				{else}
 					{lang}wcf.bbcode.quote.title{/lang}
 				{/if}
diff --git a/com.woltlab.wcf/templates/userInformationButtons.tpl b/com.woltlab.wcf/templates/userInformationButtons.tpl
index bd9ed1fcb2..0a5c409322 100644
--- a/com.woltlab.wcf/templates/userInformationButtons.tpl
+++ b/com.woltlab.wcf/templates/userInformationButtons.tpl
@@ -3,7 +3,7 @@
 		<ul class="buttonList iconList">
 			{content}
 				{if $user->homepage && $user->homepage != 'http://'}
-					<li><a class="jsTooltip" title="{lang}wcf.user.option.homepage{/lang}" {anchorAttributes url=$user->homepage appendClassname=false}><span class="icon icon16 fa-home"></span> <span class="invisible">{lang}wcf.user.option.homepage{/lang}</span></a></li>
+					<li><a class="jsTooltip" title="{lang}wcf.user.option.homepage{/lang}" {anchorAttributes url=$user->homepage appendClassname=false  isUgc=true}><span class="icon icon16 fa-home"></span> <span class="invisible">{lang}wcf.user.option.homepage{/lang}</span></a></li>
 				{/if}
 				
 				{if $user->userID != $__wcf->user->userID}
diff --git a/wcfsetup/install/files/lib/data/article/content/ArticleContent.class.php b/wcfsetup/install/files/lib/data/article/content/ArticleContent.class.php
index b7043678cb..f5216fdcbf 100644
--- a/wcfsetup/install/files/lib/data/article/content/ArticleContent.class.php
+++ b/wcfsetup/install/files/lib/data/article/content/ArticleContent.class.php
@@ -81,6 +81,7 @@ class ArticleContent extends DatabaseObject implements ILinkableObject, IRouteCo
 		else {
 			$htmlOutputProcessor = new HtmlOutputProcessor();
 			$htmlOutputProcessor->setOutputType('text/plain');
+			$htmlOutputProcessor->enableUgc(false);
 			$htmlOutputProcessor->process($this->content, 'com.woltlab.wcf.article.content', $this->articleContentID, false, $this->languageID);
 			
 			return nl2br(StringUtil::encodeHTML(StringUtil::truncate($htmlOutputProcessor->getHtml(), 500)), false);
@@ -94,6 +95,7 @@ class ArticleContent extends DatabaseObject implements ILinkableObject, IRouteCo
 	 */
 	public function getFormattedContent() {
 		$processor = new HtmlOutputProcessor();
+		$processor->enableUgc(false);
 		$processor->process($this->content, 'com.woltlab.wcf.article.content', $this->articleContentID, false, $this->languageID);
 		
 		return $processor->getHtml();
@@ -106,6 +108,7 @@ class ArticleContent extends DatabaseObject implements ILinkableObject, IRouteCo
 	 */
 	public function getAmpFormattedContent() {
 		$processor = new AmpHtmlOutputProcessor();
+		$processor->enableUgc(false);
 		$processor->process($this->content, 'com.woltlab.wcf.article.content', $this->articleContentID);
 		
 		return $processor->getHtml();
@@ -149,6 +152,7 @@ class ArticleContent extends DatabaseObject implements ILinkableObject, IRouteCo
 			case 'text/plain':
 				$processor = new HtmlOutputProcessor();
 				$processor->setOutputType('text/plain');
+				$processor->enableUgc(false);
 				$processor->process($this->content, 'com.woltlab.wcf.article.content', $this->articleContentID);
 				
 				return $processor->getHtml();
@@ -156,6 +160,7 @@ class ArticleContent extends DatabaseObject implements ILinkableObject, IRouteCo
 				// parse and return message
 				$processor = new HtmlOutputProcessor();
 				$processor->setOutputType('text/simplified-html');
+				$processor->enableUgc(false);
 				$processor->process($this->content, 'com.woltlab.wcf.article.content', $this->articleContentID);
 				
 				return $processor->getHtml();
diff --git a/wcfsetup/install/files/lib/data/box/content/BoxContent.class.php b/wcfsetup/install/files/lib/data/box/content/BoxContent.class.php
index c09ae8ec2a..d8ab70f7d7 100644
--- a/wcfsetup/install/files/lib/data/box/content/BoxContent.class.php
+++ b/wcfsetup/install/files/lib/data/box/content/BoxContent.class.php
@@ -103,6 +103,7 @@ class BoxContent extends DatabaseObject {
 	 */
 	public function getFormattedContent() {
 		$processor = new HtmlOutputProcessor();
+		$processor->enableUgc(false);
 		$processor->process($this->content, 'com.woltlab.wcf.box.content', $this->boxContentID);
 		
 		return $processor->getHtml();
diff --git a/wcfsetup/install/files/lib/data/custom/option/CustomOption.class.php b/wcfsetup/install/files/lib/data/custom/option/CustomOption.class.php
index c55cde48b3..168e60950e 100644
--- a/wcfsetup/install/files/lib/data/custom/option/CustomOption.class.php
+++ b/wcfsetup/install/files/lib/data/custom/option/CustomOption.class.php
@@ -177,7 +177,7 @@ abstract class CustomOption extends Option implements ITitledObject {
 			
 			/** @noinspection PhpMissingBreakStatementInspection */
 			case 'URL':
-				if (!$forcePlaintext) return StringUtil::getAnchorTag($this->optionValue);
+				if (!$forcePlaintext) return StringUtil::getAnchorTag($this->optionValue, '', true, true);
 				// fallthrough
 				
 			default:
diff --git a/wcfsetup/install/files/lib/data/page/content/PageContent.class.php b/wcfsetup/install/files/lib/data/page/content/PageContent.class.php
index 4434f93e48..dbb4e95b0e 100644
--- a/wcfsetup/install/files/lib/data/page/content/PageContent.class.php
+++ b/wcfsetup/install/files/lib/data/page/content/PageContent.class.php
@@ -47,6 +47,7 @@ class PageContent extends DatabaseObject implements ILinkableObject {
 		MessageEmbeddedObjectManager::getInstance()->loadObjects('com.woltlab.wcf.page.content', [$this->pageContentID]);
 		
 		$processor = new HtmlOutputProcessor();
+		$processor->enableUgc(false);
 		$processor->process($this->content, 'com.woltlab.wcf.page.content', $this->pageContentID);
 		
 		return $processor->getHtml();
diff --git a/wcfsetup/install/files/lib/system/bbcode/MediaBBCode.class.php b/wcfsetup/install/files/lib/system/bbcode/MediaBBCode.class.php
index 49fca2711b..f0ecae4472 100644
--- a/wcfsetup/install/files/lib/system/bbcode/MediaBBCode.class.php
+++ b/wcfsetup/install/files/lib/system/bbcode/MediaBBCode.class.php
@@ -23,7 +23,7 @@ class MediaBBCode extends AbstractBBCode {
 			foreach (BBCodeMediaProvider::getCache() as $provider) {
 				if ($provider->matches($content)) {
 					if ($parser instanceof HtmlBBCodeParser && $parser->getIsGoogleAmp()) {
-						return StringUtil::getAnchorTag($content);
+						return StringUtil::getAnchorTag($content, '', true, true);
 					}
 					else {
 						return $provider->getOutput($content);
@@ -34,7 +34,7 @@ class MediaBBCode extends AbstractBBCode {
 		else if ($parser->getOutputType() == 'text/simplified-html' && !$parser->getRemoveLinks()) {
 			foreach (BBCodeMediaProvider::getCache() as $provider) {
 				if ($provider->matches($content)) {
-					return StringUtil::getAnchorTag($content);
+					return StringUtil::getAnchorTag($content, '', true, true);
 				}
 			}
 		}
diff --git a/wcfsetup/install/files/lib/system/bbcode/SimpleMessageParser.class.php b/wcfsetup/install/files/lib/system/bbcode/SimpleMessageParser.class.php
index ff1b66526a..f9150502b2 100644
--- a/wcfsetup/install/files/lib/system/bbcode/SimpleMessageParser.class.php
+++ b/wcfsetup/install/files/lib/system/bbcode/SimpleMessageParser.class.php
@@ -201,7 +201,7 @@ class SimpleMessageParser extends SingletonFactory {
 				$url = 'http://'.$url;
 			}
 			
-			$text = str_replace($hash, StringUtil::getAnchorTag($url), $text);
+			$text = str_replace($hash, StringUtil::getAnchorTag($url, '', true, true), $text);
 		}
 		
 		foreach ($this->cachedEmails as $hash => $email) {
diff --git a/wcfsetup/install/files/lib/system/html/output/HtmlOutputProcessor.class.php b/wcfsetup/install/files/lib/system/html/output/HtmlOutputProcessor.class.php
index ea9ec8400b..e414efc566 100644
--- a/wcfsetup/install/files/lib/system/html/output/HtmlOutputProcessor.class.php
+++ b/wcfsetup/install/files/lib/system/html/output/HtmlOutputProcessor.class.php
@@ -47,6 +47,12 @@ class HtmlOutputProcessor extends AbstractHtmlProcessor {
 	 */
 	protected $outputType = 'text/html';
 	
+	/**
+	 * enables rel=ugc for external links
+	 * @var bool
+	 */
+	protected $ugc = true;
+	
 	/**
 	 * Processes the input html string.
 	 *
@@ -113,4 +119,22 @@ class HtmlOutputProcessor extends AbstractHtmlProcessor {
 		
 		return $this->htmlOutputNodeProcessor;
 	}
+	
+	/**
+	 * Enables rel=ugc for external links.
+	 * 
+	 * @param bool $enable
+	 */
+	public function enableUgc($enable = true) {
+		$this->ugc = $enable;
+	}
+	
+	/**
+	 * Returns true, if content is user-generated.
+	 * 
+	 * @return bool
+	 */
+	public function isUgc() {
+		return $this->ugc;
+	}
 }
diff --git a/wcfsetup/install/files/lib/system/html/output/node/HtmlOutputNodeA.class.php b/wcfsetup/install/files/lib/system/html/output/node/HtmlOutputNodeA.class.php
index 2c46cd1287..9ec37e7af6 100644
--- a/wcfsetup/install/files/lib/system/html/output/node/HtmlOutputNodeA.class.php
+++ b/wcfsetup/install/files/lib/system/html/output/node/HtmlOutputNodeA.class.php
@@ -32,7 +32,8 @@ class HtmlOutputNodeA extends AbstractHtmlOutputNode {
 				$element->setAttribute('href', preg_replace('~^https?://~', RouteHandler::getProtocol(), $href));
 			}
 			else {
-				self::markLinkAsExternal($element);
+				/** @var HtmlOutputNodeProcessor $htmlNodeProcessor */
+				self::markLinkAsExternal($element, $htmlNodeProcessor->getHtmlProcessor()->isUgc());
 			}
 			
 			$value = StringUtil::trim($element->textContent);
@@ -67,8 +68,9 @@ class HtmlOutputNodeA extends AbstractHtmlOutputNode {
 	 * Marks an element as external.
 	 * 
 	 * @param       \DOMElement     $element
+	 * @param       bool            $isUgc
 	 */
-	public static function markLinkAsExternal(\DOMElement $element) {
+	public static function markLinkAsExternal(\DOMElement $element, $isUgc = false) {
 		$element->setAttribute('class', 'externalURL');
 		
 		$rel = 'nofollow';
@@ -77,6 +79,10 @@ class HtmlOutputNodeA extends AbstractHtmlOutputNode {
 			
 			$element->setAttribute('target', '_blank');
 		}
+		if ($isUgc) {
+			$rel .= ' ugc';
+		}
+		
 		$element->setAttribute('rel', $rel);
 		
 		// If the link contains only a single image that is floated to the right,
diff --git a/wcfsetup/install/files/lib/system/html/output/node/HtmlOutputNodeImg.class.php b/wcfsetup/install/files/lib/system/html/output/node/HtmlOutputNodeImg.class.php
index 6f4e0b9050..0b9fa6ca41 100644
--- a/wcfsetup/install/files/lib/system/html/output/node/HtmlOutputNodeImg.class.php
+++ b/wcfsetup/install/files/lib/system/html/output/node/HtmlOutputNodeImg.class.php
@@ -85,7 +85,8 @@ class HtmlOutputNodeImg extends AbstractHtmlOutputNode {
 					if (IMAGE_PROXY_INSECURE_ONLY && $urlComponents['scheme'] === 'https') {
 						// proxy is enabled for insecure connections only
 						if (!IMAGE_ALLOW_EXTERNAL_SOURCE && !$this->isAllowedOrigin($src)) {
-							$this->replaceExternalSource($element, $src);
+							/** @var HtmlOutputNodeProcessor $htmlNodeProcessor */
+							$this->replaceExternalSource($element, $src, $htmlNodeProcessor->getHtmlProcessor()->isUgc());
 						}
 						
 						continue;
@@ -133,7 +134,8 @@ class HtmlOutputNodeImg extends AbstractHtmlOutputNode {
 					}
 				}
 				else if (!IMAGE_ALLOW_EXTERNAL_SOURCE && !$this->isAllowedOrigin($src)) {
-					$this->replaceExternalSource($element, $src);
+					/** @var HtmlOutputNodeProcessor $htmlNodeProcessor */
+					$this->replaceExternalSource($element, $src, $htmlNodeProcessor->getHtmlProcessor()->isUgc());
 				}
 				else if (MESSAGE_FORCE_SECURE_IMAGES && Url::parse($src)['scheme'] === 'http') {
 					// rewrite protocol to `https`
@@ -148,15 +150,16 @@ class HtmlOutputNodeImg extends AbstractHtmlOutputNode {
 	 * 
 	 * @param       \DOMElement     $element
 	 * @param       string          $src
+	 * @param       bool            $isUgc
 	 */
-	protected function replaceExternalSource(\DOMElement $element, $src) {
+	protected function replaceExternalSource(\DOMElement $element, $src, $isUgc = false) {
 		$element->parentNode->insertBefore($element->ownerDocument->createTextNode('['.WCF::getLanguage()->get('wcf.bbcode.image.blocked').': '), $element);
 		
 		if (!DOMUtil::hasParent($element, 'a')) {
 			$link = $element->ownerDocument->createElement('a');
 			$link->setAttribute('href', $src);
 			$link->textContent = $src;
-			HtmlOutputNodeA::markLinkAsExternal($link);
+			HtmlOutputNodeA::markLinkAsExternal($link, $isUgc);
 		}
 		else {
 			$link = $element->ownerDocument->createTextNode($src);
diff --git a/wcfsetup/install/files/lib/system/option/user/FacebookUserOptionOutput.class.php b/wcfsetup/install/files/lib/system/option/user/FacebookUserOptionOutput.class.php
index 741eca8f00..14a4c053c3 100644
--- a/wcfsetup/install/files/lib/system/option/user/FacebookUserOptionOutput.class.php
+++ b/wcfsetup/install/files/lib/system/option/user/FacebookUserOptionOutput.class.php
@@ -19,6 +19,6 @@ class FacebookUserOptionOutput implements IUserOptionOutput {
 	public function getOutput(User $user, UserOption $option, $value) {
 		if (empty($value)) return '';
 		
-		return StringUtil::getAnchorTag('https://www.facebook.com/'.$value, $value);
+		return StringUtil::getAnchorTag('https://www.facebook.com/'.$value, $value, true, true);
 	}
 }
diff --git a/wcfsetup/install/files/lib/system/option/user/TwitterUserOptionOutput.class.php b/wcfsetup/install/files/lib/system/option/user/TwitterUserOptionOutput.class.php
index d9fc30ccf9..6d28096ec5 100644
--- a/wcfsetup/install/files/lib/system/option/user/TwitterUserOptionOutput.class.php
+++ b/wcfsetup/install/files/lib/system/option/user/TwitterUserOptionOutput.class.php
@@ -19,6 +19,6 @@ class TwitterUserOptionOutput implements IUserOptionOutput {
 	public function getOutput(User $user, UserOption $option, $value) {
 		if (empty($value)) return '';
 		
-		return StringUtil::getAnchorTag('https://twitter.com/'.$value, $value);
+		return StringUtil::getAnchorTag('https://twitter.com/'.$value, $value, true, true);
 	}
 }
diff --git a/wcfsetup/install/files/lib/system/option/user/URLUserOptionOutput.class.php b/wcfsetup/install/files/lib/system/option/user/URLUserOptionOutput.class.php
index d0080932c1..0f2f1822df 100644
--- a/wcfsetup/install/files/lib/system/option/user/URLUserOptionOutput.class.php
+++ b/wcfsetup/install/files/lib/system/option/user/URLUserOptionOutput.class.php
@@ -21,7 +21,7 @@ class URLUserOptionOutput implements IUserOptionOutput {
 		
 		$value = self::getURL($value);
 		
-		return StringUtil::getAnchorTag($value, $value);
+		return StringUtil::getAnchorTag($value, $value, true, true);
 	}
 	
 	/**
diff --git a/wcfsetup/install/files/lib/system/template/plugin/AnchorAttributesFunctionTemplatePlugin.class.php b/wcfsetup/install/files/lib/system/template/plugin/AnchorAttributesFunctionTemplatePlugin.class.php
index bd7f21aa52..4fc465095a 100644
--- a/wcfsetup/install/files/lib/system/template/plugin/AnchorAttributesFunctionTemplatePlugin.class.php
+++ b/wcfsetup/install/files/lib/system/template/plugin/AnchorAttributesFunctionTemplatePlugin.class.php
@@ -13,6 +13,7 @@ use wcf\util\StringUtil;
  * Optional parameter:
  *      `appendHref` (bool, default true)
  * 	`appendClassname` (bool, default true)
+ *      `isUgc` (bool, default false)
  *
  * Usage:
  * 	{anchorAttributes url=$url}
@@ -34,6 +35,7 @@ class AnchorAttributesFunctionTemplatePlugin implements IFunctionTemplatePlugin
 		$url = $tagArgs['url'];
 		$appendClassname = $tagArgs['appendClassname'] ?? true;
 		$appendHref = $tagArgs['appendHref'] ?? true;
+		$isUgc = $tagArgs['isUgc'] ?? false;
 		
 		$external = true;
 		if (ApplicationHandler::getInstance()->isInternalURL($url)) {
@@ -56,6 +58,9 @@ class AnchorAttributesFunctionTemplatePlugin implements IFunctionTemplatePlugin
 				$rel .= ' noopener noreferrer';
 				$attributes .= 'target="_blank"';
 			}
+			if ($isUgc) {
+				$rel .= ' ugc';
+			}
 			
 			$attributes .= ' rel="' . $rel . '"';
 		}
diff --git a/wcfsetup/install/files/lib/util/StringUtil.class.php b/wcfsetup/install/files/lib/util/StringUtil.class.php
index d3708a0d4b..ecdc830113 100644
--- a/wcfsetup/install/files/lib/util/StringUtil.class.php
+++ b/wcfsetup/install/files/lib/util/StringUtil.class.php
@@ -667,9 +667,10 @@ final class StringUtil {
 	 * @param	string		$url
 	 * @param	string		$title
 	 * @param	boolean		$encodeTitle
+	 * @param       boolean         $isUgc          true to add rel=ugc to the anchor tag 
 	 * @return	string		anchor tag
 	 */
-	public static function getAnchorTag($url, $title = '', $encodeTitle = true) {
+	public static function getAnchorTag($url, $title = '', $encodeTitle = true, $isUgc = false) {
 		$url = self::trim($url);
 		
 		// cut visible url
@@ -684,17 +685,18 @@ final class StringUtil {
 			if (!$encodeTitle) $title = self::encodeHTML($title);
 		}
 		
-		return '<a '. self::getAnchorTagAttributes($url) .'>' . ($encodeTitle ? self::encodeHTML($title) : $title) . '</a>';
+		return '<a '. self::getAnchorTagAttributes($url, $isUgc) .'>' . ($encodeTitle ? self::encodeHTML($title) : $title) . '</a>';
 	}
 	
 	/**
 	 * Generates the attributes for an anchor tag from given URL.
 	 *
 	 * @param	string		$url
+	 * @param       boolean         $isUgc          true to add rel=ugc to the attributes
 	 * @return	string		attributes
 	 * @since       5.3
 	 */
-	public static function getAnchorTagAttributes($url) {
+	public static function getAnchorTagAttributes($url, $isUgc = false) {
 		$external = true;
 		if (ApplicationHandler::getInstance()->isInternalURL($url)) {
 			$external = false;
@@ -709,6 +711,9 @@ final class StringUtil {
 				$rel .= ' noopener noreferrer';
 				$attributes .= 'target="_blank"';
 			}
+			if ($isUgc) {
+				$rel .= ' ugc';
+			}
 			
 			$attributes .= ' rel="' . $rel . '"';
 		}
-- 
2.20.1