From 0635bb68eb4bf117e0da80aa35249ea89cb4bf6d Mon Sep 17 00:00:00 2001
From: Ayke Halder <rr-it@users.noreply.github.com>
Date: Fri, 19 Sep 2025 11:53:11 +0200
Subject: [PATCH] Allow target attribute for anchor tags in html-sanitizer

* Allow target attribute for anchor tags in html-sanitizer

Signed-off-by: Ayke Halder <rr-it@users.noreply.github.com>
Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
Co-authored-by: Alexander Schwartz <aschwart@redhat.com>
---
 .../theme/KeycloakSanitizerPolicy.java        |  3 +++
 .../keycloak/theme/KeycloakSanitizerTest.java | 21 +++++++++++++++++++
 2 files changed, 24 insertions(+)

diff --git a/services/src/main/java/org/keycloak/theme/KeycloakSanitizerPolicy.java b/services/src/main/java/org/keycloak/theme/KeycloakSanitizerPolicy.java
index deaf8ea667e..414092b9e2e 100644
--- a/services/src/main/java/org/keycloak/theme/KeycloakSanitizerPolicy.java
+++ b/services/src/main/java/org/keycloak/theme/KeycloakSanitizerPolicy.java
@@ -62,6 +62,8 @@ public class KeycloakSanitizerPolicy {
 
   private static final Pattern NAME = Pattern.compile("[a-zA-Z0-9\\-_\\$]+");
 
+  private static final Pattern TARGET = Pattern.compile("_blank");
+
   private static final Pattern ALIGN = Pattern.compile(
       "(?i)center|left|right|justify|char");
 
@@ -102,6 +104,7 @@ public class KeycloakSanitizerPolicy {
           .allowStandardUrlProtocols()
           .allowAttributes("nohref").onElements("a")
           .allowAttributes("name").matching(NAME).onElements("a")
+          .allowAttributes("target").matching(TARGET).onElements("a")
           .allowAttributes(
               "onfocus", "onblur", "onclick", "onmousedown", "onmouseup")
               .matching(HISTORY_BACK).onElements("a")
diff --git a/services/src/test/java/org/keycloak/theme/KeycloakSanitizerTest.java b/services/src/test/java/org/keycloak/theme/KeycloakSanitizerTest.java
index d3e9df2338f..db9a9f84344 100644
--- a/services/src/test/java/org/keycloak/theme/KeycloakSanitizerTest.java
+++ b/services/src/test/java/org/keycloak/theme/KeycloakSanitizerTest.java
@@ -60,6 +60,27 @@ public class KeycloakSanitizerTest {
         assertResult(expectedResult, html);
     }
 
+    @Test
+    public void testLinks() throws Exception {
+        List<String> html = new ArrayList<>();
+
+        html.add("<a href=\"https://www.example.org/sub-page\">Link text</a>");
+        String expectedResult = "<a href=\"https://www.example.org/sub-page\" rel=\"nofollow\">Link text</a>";
+        assertResult(expectedResult, html);
+
+        html.set(0, "<a href=\"https://www.example.org/terms-of-service\" target=\"_blank\">Link text</a>");
+        expectedResult = "<a href=\"https://www.example.org/terms-of-service\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Link text</a>";
+        assertResult(expectedResult, html);
+
+        html.set(0, "<a href=\"https://www.example.org/sub-page\" target=\"_top\">Link text</a>");
+        expectedResult = "<a href=\"https://www.example.org/sub-page\" rel=\"nofollow\">Link text</a>";
+        assertResult(expectedResult, html);
+
+        html.set(0, "<a href=\"https://www.example.org/sub-page\" target=\"someframe\">Link text</a>");
+        expectedResult = "<a href=\"https://www.example.org/sub-page\" rel=\"nofollow\">Link text</a>";
+        assertResult(expectedResult, html);
+    }
+
     @Test
     public void testUrls() throws Exception {
         List<String> html = new ArrayList<>();