Links in Trac tickets should be nofollow'd

[jonoaldersonwp]

Links in trac tickets should have a rel="nofollow" attribute, in order to reduce the attraction of the platform as a target for spammers.

[dd32]

Unfortunately Trac doesn't allow an easy way to do this.

​https://trac.edgewall.org/ticket/3352 was closed as wontfix

The only way to achieve this is to write a Trac plugin, as comment content can't be altered within a Trac template.

[jonoaldersonwp]

Can we write a Trac plugin?
Their legacy bad decisions shouldn't result in us leaving holes in our defences :)

[dd32]

We can, but we're not writing/deploying new plugins due to the lack of people to maintain them ongoing.

[dd32]

In 11548:

Trac: Mark links in ticket descriptions/comments as rel="ugc nofollow".

Fixes #4950.

[dd32]

Well, that definitely worked.

$ curl -s https://meta.trac.wordpress.org/ticket/4950 | grep 'ext-link'

<a class="ext-link" rel="ugc nofollow" href="https://trac.edgewall.org/ticket/3352"><span class="icon"></span>https://trac.edgewall.org/ticket/3352</a> was closed as wontfix<br />

[dd32]

Oh, also, just noting that you can't do a py:match against a.ext-link, as it seems that it can only match on elements that exist within the templates, not against the dynamic content inserted within those template tags.. although you can filter the template stream within the template tags as shown in the commit above.

[dd32]

In 11565:

Trac: Revert [11548] to see if it's caused #6112.

See #6112, #4950.

[dd32]

In 11583:

Trac: Mark links in ticket descriptions/comments as rel="ugc nofollow". Take two.

[11548] was previously applying to all 'searchable' elements which includes the code browser.
The code browser uses a different String class, and being treated as a Markup string caused it to strip content that was unexpected within it.
This implements [11548] again verifying the specific string classes which we can alter, and narrowing it further by only applying to the ticket/comment classes and only when ext-link is present, to reduce potential breakage.

Fixes #4950.

[dd32]

Re-opening because this isn't applying now, at least to prbot comments.

This has been causing some problems with the increase in GitHub spam which has been syncing through to WordPress.org Tracs.

Example: This link should be nofollowed, but isn't: ​https://example.org/

[dd32]

Somewhat annoyingly this is still working in my test Trac environment, so I'm not sure what the issue is, or how to debug it.

[johnbillion]

Would be good to look into this again to see if we can curb some of the recent Trac spam.