PlaceholdersPostFilter only updates <a href> when matches expected

What does this MR do and why?

<a href> is a security-relevant attribute; don't "update" it to match another value if it doesn't match the original value in the first place.

There is no outstanding security issue this addresses; it's a correctness and defense-in-depth matter that we should be doing anyway. Closes Only update image parent <a> href in if it matc... (#588831).

How to set up and validate locally

  1. Check out the branch.
  2. Enable the markdown_placeholders FF.
  3. Enter the following Markdown into a comment/issue/MR description/etc.:
    [![](http://%{gitlab_server}:3000/apple-touch-icon.png)](https://elsewhere.example)
  4. The image should display correctly, but it should still link to https://elsewhere.example, and not the image.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Merge request reports

Loading