External hyperlinks in task descriptions should use rel=noreferrer for security and privacy

[nekohayo]

Checklist

• I verified that Kanboard is correctly installed
• I verified that the problem does not come from a plugin
• I verified that the problem is not already reported
• I understand that Kanboard is in maintenance mode. It doesn't mean it's abandoned, but there is no significant feature development

Actual behaviour

Hyperlinks generated from Markdown hyperlinks or bare URLs in task descriptions do not have any attributes/tags associated with them. The problem is, this will open in the same tab and pass on the source/referrer information to the destination website, which is certainly not something you'd want from a private/personal kanban board.

Expected behaviour

In task details pages, and task description hover tooltips inside a board view (or anywhere else where a task description may be shown), hyperlinks to external websites should have:

• The rel=noreferrer attribute (see this MDN information page; apparently this implicitly includes noopener too)
• Probably target=_blank too so that it opens in a new tab, instead of replacing the kanboard task page
• Maybe also the title=the_URL attribute to display the URL as a direct tooltip on hover when a "pretty" (non-bare) hyperlink is used, though that's probably less necessary as the browser can also reveal the URL through the statusbar

Steps to reproduce

Write a hyperlink into the description of a task, such as this for example:

We should do something like [this website](https://some_example_untrusted_website.com), it's pretty cool but their tracking is worrisome.

...then inspect the resulting HTML code with the browser's web inspector (F12).

Configuration

• Kanboard version: 1.2.35
• Database type and version: SQLite 3.40.1
• PHP version: 8.2.18
• OS: Fedora 39
• Browser: Firefox 125

[fguillot]

Kanboard is already doing that. There is a meta tag that applies the no-referrer rule to all outgoing links.

kanboard/app/Template/layout.php

Line 9 in fc72abd

<meta name="referrer" content="no-referrer">

You can verify that no referrer is sent to third-party website by making a Markdown link to https://httpbin.org/headers for example.

Regarding the target=_blank, apparently it's a bad practice in term of accessibility, especially for those using a screen reader.

More info here:

• https://www.w3.org/TR/WCAG20-TECHS/G200.html
• https://css-tricks.com/use-target_blank/
• https://codersblock.com/blog/external-links-new-tabs-and-accessibility/#accessibility-implications

Adding target=_blank everywhere would prevent people to use the default browser behavior (opening the link the in current tab). Looks like GitHub Issues made this choice as well.