From 6b0f3f69c380f8e4c31c6d54197c65ccf82eb149 Mon Sep 17 00:00:00 2001
From: Johannes Meyer <johannes.meyer@icinga.com>
Date: Fri, 4 Feb 2022 12:48:35 +0100
Subject: [PATCH] LinkTransformer: Don't load any external url in an iframe

---
 .../Web/Helper/Markdown/LinkTransformer.php   | 25 +++----------------
 1 file changed, 4 insertions(+), 21 deletions(-)

diff --git a/library/Icinga/Web/Helper/Markdown/LinkTransformer.php b/library/Icinga/Web/Helper/Markdown/LinkTransformer.php
index 781bd0546..f323085d5 100644
--- a/library/Icinga/Web/Helper/Markdown/LinkTransformer.php
+++ b/library/Icinga/Web/Helper/Markdown/LinkTransformer.php
@@ -9,21 +9,6 @@ use ipl\Web\Url;
 
 class LinkTransformer extends HTMLPurifier_AttrTransform
 {
-    /**
-     * Link targets with such a file extension are not loaded by an iFrame
-     *
-     * @var string[]
-     */
-    public static $NON_IFRAME_FILES = [
-        'html',
-        'htm',
-        'php',
-        'svg',
-        'aspx',
-        'cshtml',
-        'vbhtml'
-    ];
-
     /**
      * Link targets that are considered to have a thumbnail
      *
@@ -55,19 +40,17 @@ class LinkTransformer extends HTMLPurifier_AttrTransform
         }
 
         $hasThumbnail = $ext !== null && in_array($ext, static::$IMAGE_FILES, true);
-        $useIframe = $ext !== null && ! in_array($ext, static::$NON_IFRAME_FILES, true);
-
         if ($hasThumbnail) {
             // I would have liked to not only base this off of the extension, but also by
             // whether there is an actual img tag inside the anchor. Seems not possible :(
             $attr['class'] = 'with-thumbnail';
         }
 
-        if ((! isset($attr['target']) || ! in_array($attr['target'], ['_blank', '_self']))) {
-            if ($useIframe) {
-                $attr['href'] = Url::fromPath('iframe', ['url' => $url])->getAbsoluteUrl();
-            } elseif ($url->isExternal()) {
+        if (! isset($attr['target'])) {
+            if ($url->isExternal()) {
                 $attr['target'] = '_blank';
+            } else {
+                $attr['data-base-target'] = '_next';
             }
         }