rehype-external-links

!Buildbuild-badgebuild !Coveragecoverage-badgecoverage !Downloadsdownloads-badgedownloads !Sizesize-badgesize !Sponsorssponsors-badgecollective !Backersbackers-badgecollective !Chatchat-badgechat
rehype plugin to add rel (and target) to external links.

Contents

• What is this?
• When should I use this?
• Install
• Use
• API

*   [`unified().use(rehypeExternalLinks[, options])`](#unifieduserehypeexternallinks-options)
*   [`CreateContent`](#createcontent)
*   [`CreateProperties`](#createproperties)
*   [`CreateRel`](#createrel)
*   [`CreateTarget`](#createtarget)
*   [`Options`](#options)
*   [`Target`](#target)

• Types
• Compatibility
• Security
• Contribute
• License

What is this?

This package is a unified (rehype) plugin to add rel (and target) attributes to external links. It is particularly useful when displaying user content on your reputable site, because users could link to disreputable sources (spam, scams, etc), as search engines and other bots will discredit your site for linking to them (or legitimize their sites). In short: linking to something signals trust, but you can’t trust users. This plugin adds certain rel attributes to prevent that from happening.
unified is a project that transforms content with abstract syntax trees (ASTs). rehype adds support for HTML to unified. hast is the HTML AST that rehype uses. This is a rehype plugin that adds rel (and target) to <a>s in the AST.

When should I use this?

This project is useful when you want to display user content from authors you don’t trust (such as comments), as they might include links you don’t endorse, on your website.

Install

This package is ESM onlyesm. In Node.js (version 16+), install with npm:

npm install rehype-external-links

In Deno with esm.shesmsh:

import rehypeExternalLinks from 'https://esm.sh/rehype-external-links@3'

In browsers with esm.shesmsh:

<script type="module">
  import rehypeExternalLinks from 'https://esm.sh/rehype-external-links@3?bundle'
</script>

Use

Say our module example.js contains:

import rehypeExternalLinks from 'rehype-external-links'
import remarkParse from 'remark-parse'
import remarkRehype from 'remark-rehype'
import rehypeStringify from 'rehype-stringify'
import {unified} from 'unified'

const file = await unified()
  .use(remarkParse)
  .use(remarkRehype)
  .use(rehypeExternalLinks, {rel: ['nofollow']})
  .use(rehypeStringify)
  .process('[rehype](https://github.com/rehypejs/rehype)')

console.log(String(file))

…then running node example.js yields:

<p><a href="https://github.com/rehypejs/rehype" rel="nofollow">rehype</a></p>

API

This package exports no identifiers. The default export is rehypeExternalLinksapi-rehype-external-links.

unified().use(rehypeExternalLinks[, options])

Automatically add rel (and target?) to external links.

Parameters

• options (Optionsapi-options, optional)

— configuration

Returns

Transform (Transformerunified-transformer).

Notes

You should likely not configure targetcss-tricks.
You should at least set rel to ['nofollow']. When using a target, add noopener and noreferrer to avoid exploitation of the window.opener API.
When using a target, you should set content to adhere to accessibility guidelines by giving users advanced warning when opening a new windowg201.

CreateContent

Create a target for the element (TypeScript type).

Parameters

• element (Elementhast-element)

— element to check

Returns

Content to add (Array<Node> or Node, optional).

CreateProperties

Create properties for an element (TypeScript type).

Parameters

• element (Elementhast-element)

— element to check

Returns

Properties to add (Propertieshast-properties, optional).

CreateRel

Create a rel for the element (TypeScript type).

Parameters

• element (Elementhast-element)

— element to check

Returns

rel to use (Array<string>, optional).

CreateTarget

Create a target for the element (TypeScript type).

Parameters

• element (Elementhast-element)

— element to check

Returns

target to use (Targetapi-target, optional).

Options

Configuration (TypeScript type).

Fields

• content (Array<Node>, CreateContentapi-create-content, or Node,

optional)
— content to insert at the end of external links; will be inserted in a
`<span>` element; useful for improving accessibility by giving users
advanced warning when opening a new window

• contentProperties (CreatePropertiesapi-create-properties or

[`Properties`][hast-properties], optional)
— properties to add to the `span` wrapping `content`

• properties (CreatePropertiesapi-create-properties or

[`Properties`][hast-properties], optional)
— properties to add to the link itself

• protocols (Array<string>, default: ['http', 'https'])

— protocols to see as external, such as `mailto` or `tel`

• rel (Array<string>, CreateRelapi-create-rel, or string,

default: `['nofollow']`)
— [link types][mdn-rel] to hint about the referenced documents; pass an
empty array (`[]`) to not set `rel`s on links; when using a `target`, add `noopener`
and `noreferrer` to avoid exploitation of the `window.opener` API

• target (CreateTargetapi-create-target or Targetapi-target,

optional)
— how to display referenced documents; the default (nothing) is to not set
`target`s on links

• test (Testis-test, optional)

— extra test to define which external link elements are modified; any test
that can be given to `hast-util-is-element` is supported

Target

Target (TypeScript type).

Type

type Target = '_blank' | '_parent' | '_self' | '_top'

Types

This package is fully typed with TypeScript. It exports the additional types CreateContentapi-create-content, CreatePropertiesapi-create-properties, CreateRelapi-create-rel, CreateTargetapi-create-target, Optionsapi-options, and Targetapi-target.

Compatibility

Projects maintained by the unified collective are compatible with maintained versions of Node.js.
When we cut a new major release, we drop support for unmaintained versions of Node. This means we try to keep the current release line, rehype-external-links@^3, compatible with Node.js 16.
This plugin works with rehype-parse version 3+, rehype-stringify version 3+, rehype version 4+, and unified version 6+.

Security

Improper use of rehype-external-links can open you up to a cross-site scripting (XSS)xss attack.
Either do not combine this plugin with user content or use rehype-sanitizerehype-sanitize.

Contribute

See contributing.mdcontributing in rehypejs/.githubhealth for ways to get started. See support.mdsupport for ways to get help.
This project has a code of conductcoc. By interacting with this repository, organization, or community you agree to abide by its terms.

License

MITlicense © Titus Wormerauthor