Support HTML links with rel attr in ApplyBasicAccessibleMarkdown

Ref T874 T744

posts/render.go

@@ -64,24 +64,27 @@ func ApplyBasicMarkdown(data []byte) string {
 }
 
 // ApplyBasicAccessibleMarkdown applies Markdown to the given data, rendering basic text formatting and preserving hard
-// line breaks. It is meant for formatting text in small, multi-line UI elements, like user profile biographies.
+// line breaks in HTML. It is meant for formatting text in small, multi-line UI elements, like user profile biographies.
 func ApplyBasicAccessibleMarkdown(data []byte) string {
 	mdExtensions := 0 |
 		blackfriday.EXTENSION_STRIKETHROUGH |
 		blackfriday.EXTENSION_SPACE_HEADERS |
 		blackfriday.EXTENSION_HEADER_IDS |
 		blackfriday.EXTENSION_HARD_LINE_BREAK
 	htmlFlags := 0 |
-		blackfriday.HTML_SKIP_HTML |
 		blackfriday.HTML_USE_SMARTYPANTS |
+		blackfriday.HTML_USE_XHTML |
 		blackfriday.HTML_SMARTYPANTS_DASHES
 
 	// Generate Markdown
 	md := blackfriday.Markdown([]byte(data), blackfriday.HtmlRenderer(htmlFlags, "", ""), mdExtensions)
 	// Strip out bad HTML
 	policy := bluemonday.UGCPolicy()
 	policy.AllowAttrs("class", "id").Globally()
+	policy.AllowAttrs("rel").OnElements("a")
+	policy.RequireNoFollowOnLinks(false)
 	outHTML := string(policy.SanitizeBytes(md))
+	// Strip surrounding <p> tags that blackfriday adds
 	outHTML = markeddownReg.ReplaceAllString(outHTML, "$1")
 	outHTML = strings.TrimRightFunc(outHTML, unicode.IsSpace)