Fix reverse tabnabbing vulnerability with improper URL protocol

Magdalena Frankiewiczrequested to merge
fix-reverse-tabnabbing-with-invalid-protocol-delimiter into master

What does this MR do and why?

Fixes #273659 (closed).

URLs with an invalid protocol delimiter like http:evil.com were mistakenly considered internal URLs by Banzai ExternalLinkFilter.

Therefore, the rel="nofollow noreferrer noopener" attribute was not added to the anchor, leaving the site vulnerable to reverse tabnabbing.

This commit fixes it.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Merge request reports