security: anchor tag safety

[shockey]

Description

Setting target="_blank" on anchor tags is unsafe unless used in conjunction with rel="noopener".

This PR fixes our internal usage, adapts our Markdown parser to protect against from vulnerable user input, and adds a linter rule to prevent future introductions of this vulnerability into Swagger UI.

Motivation and Context

Fixes an issue reported through our disclosure channel (email, [email protected]).

How Has This Been Tested?

XSS tests have been extended to cover these changes.

Checklist

My PR contains...

• No code changes (src/ is unmodified: changes to documentation, CI, metadata, etc.)
• Dependency changes (any modification to dependencies in package.json)
• Bug fixes (non-breaking change which fixes an issue)
• Improvements (misc. changes to existing features)
• Features (non-breaking change which adds functionality)

My changes...

• are breaking changes to a public API (config options, System API, major UI change, etc).
• are breaking changes to a private API (Redux, component props, utility functions, etc.).
• are breaking changes to a developer API (npm script behavior changes, new dev system dependencies, etc).
• are not breaking changes.

Documentation

• My changes do not require a change to the project documentation.
• My changes require a change to the project documentation.
• If yes to above: I have updated the documentation accordingly.

Automated tests

• My changes can not or do not need to be tested.
• My changes can and should be tested by unit and/or integration tests.
• If yes to above: I have added tests to cover my changes.
• If yes to above: I have taken care to cover edge cases in my tests.
• All new and existing tests passed.

[ganeshgore]

Does anchor tag safety also means ignoring hrefs with non standard port.
I am trying to add anchor tag with non standard protocol like (vscode://filename) in description part of swagger document. It seems to ignore that . Is it possible to add such URLs?

You can quick check by adding
[TestLink](vscode://file/c:/temp.txt)
in description part of https://editor.swagger.io/ example. It removes href while rendering.

[shockey]

@ganeshgore it does, currently we only allow http/https. please open a feature request if you'd like to have support for vscode:// urls 😄