diff --git a/lib/pleroma/html.ex b/lib/pleroma/html.ex
index 05253157e6e027e7ee12ae4d19d530fd80c2190a..5b152d926ed57d66b4d4acde5248955f6891d4dc 100644
--- a/lib/pleroma/html.ex
+++ b/lib/pleroma/html.ex
@@ -95,6 +95,13 @@ defmodule Pleroma.HTML.Scrubber.TwitterText do
Meta.allow_tag_with_uri_attributes("a", ["href", "data-user", "data-tag"], @valid_schemes)
Meta.allow_tag_with_these_attributes("a", ["name", "title", "class"])
+ Meta.allow_tag_with_this_attribute_values("a", "rel", [
+ "tag",
+ "nofollow",
+ "noopener",
+ "noreferrer"
+ ])
+
# paragraphs and linebreaks
Meta.allow_tag_with_these_attributes("br", [])
Meta.allow_tag_with_these_attributes("p", [])
@@ -137,6 +144,13 @@ defmodule Pleroma.HTML.Scrubber.Default do
Meta.allow_tag_with_uri_attributes("a", ["href", "data-user", "data-tag"], @valid_schemes)
Meta.allow_tag_with_these_attributes("a", ["name", "title", "class"])
+ Meta.allow_tag_with_this_attribute_values("a", "rel", [
+ "tag",
+ "nofollow",
+ "noopener",
+ "noreferrer"
+ ])
+
Meta.allow_tag_with_these_attributes("abbr", ["title"])
Meta.allow_tag_with_these_attributes("b", [])
diff --git a/test/html_test.exs b/test/html_test.exs
index 29cab17f3a7807ca8173f31d3023258aebea8bfb..0b5d3d89265fd6ee1bd3efc4e3df0219db80f027 100644
--- a/test/html_test.exs
+++ b/test/html_test.exs
@@ -10,6 +10,8 @@ defmodule Pleroma.HTMLTest do
this is in bold
this is a paragraph
this is a linebreak
+ this is a link with allowed "rel" attribute: example.com
+ this is a link with not allowed "rel" attribute: example.com
this is an image: 
"""
@@ -24,6 +26,8 @@ test "works as expected" do
this is in bold
this is a paragraph
this is a linebreak
+ this is a link with allowed "rel" attribute: example.com
+ this is a link with not allowed "rel" attribute: example.com
this is an image:
alert('hacked')
"""
@@ -44,6 +48,8 @@ test "normalizes HTML as expected" do
this is in bold
this is a paragraph
this is a linebreak
+ this is a link with allowed "rel" attribute: example.com
+ this is a link with not allowed "rel" attribute: example.com
this is an image: 
alert('hacked')
"""
@@ -66,6 +72,8 @@ test "normalizes HTML as expected" do
this is in bold
this is a paragraph
this is a linebreak
+ this is a link with allowed "rel" attribute: example.com
+ this is a link with not allowed "rel" attribute: example.com
this is an image: 
alert('hacked')
"""
diff --git a/test/web/mastodon_api/mastodon_api_controller_test.exs b/test/web/mastodon_api/mastodon_api_controller_test.exs
index 059d5237d678b496d42b332767b396834fb42ee8..74bf057082e87b90d1da894210c1b7f26de8fcc6 100644
--- a/test/web/mastodon_api/mastodon_api_controller_test.exs
+++ b/test/web/mastodon_api/mastodon_api_controller_test.exs
@@ -1632,7 +1632,7 @@ test "updates the user's bio", %{conn: conn} do
assert user = json_response(conn, 200)
assert user["note"] ==
- ~s(I drink #cofe with #cofe with @) <> user2.nickname <> ~s()
diff --git a/test/web/twitter_api/views/activity_view_test.exs b/test/web/twitter_api/views/activity_view_test.exs
index 6f0786b1c03e054afb0d3056202c166d5dc648f3..d9df01c6e74c49a092b331f9e6b04c4bd2e6b445 100644
--- a/test/web/twitter_api/views/activity_view_test.exs
+++ b/test/web/twitter_api/views/activity_view_test.exs
@@ -82,7 +82,7 @@ test "a create activity with a html status" do
result = ActivityView.render("activity.json", activity: activity)
assert result["statusnet_html"] ==
- "#Bike log - Commute Tuesday
https://pla.bike/posts/20181211/
#cycling #CHScycling #commute
MVIMG_20181211_054020.jpg"
+ "#Bike log - Commute Tuesday
https://pla.bike/posts/20181211/
#cycling #CHScycling #commute
MVIMG_20181211_054020.jpg"
assert result["text"] ==
"#Bike log - Commute Tuesday\nhttps://pla.bike/posts/20181211/\n#cycling #CHScycling #commute\nMVIMG_20181211_054020.jpg"