Merge pull request #2503 from johanrd/fix/2396

Post-merge review of #2396 (`template-link-rel-noopener`)

Author: NullVoxPopuli

lib/rules/template-link-rel-noopener.js

@@ -31,16 +31,28 @@ module.exports = {
         }
 
         const relAttr = node.attributes?.find((a) => a.name === 'rel');
-        const hasProperRel =
-          relAttr?.value?.type === 'GlimmerTextNode' &&
-          /noopener/.test(relAttr.value.chars) &&
-          /noreferrer/.test(relAttr.value.chars);
+        const relValue = relAttr?.value?.type === 'GlimmerTextNode' ? relAttr.value.chars : '';
+        const hasNoopener = /(?:^|\s)noopener(?:\s|$)/.test(relValue);
+        const hasNoreferrer = /(?:^|\s)noreferrer(?:\s|$)/.test(relValue);
+        const hasProperRel = hasNoopener && hasNoreferrer;
 
         if (!hasProperRel) {
           context.report({
             node: targetAttr,
             messageId: 'missingRel',
             fix(fixer) {
+              if (relAttr && relAttr.value?.type === 'GlimmerTextNode') {
+                // Strip existing noopener/noreferrer tokens, then re-add in canonical order
+                // (matches ember-template-lint behavior)
+                const oldValue = relAttr.value.chars.trim().replaceAll(/\s+/g, ' ');
+                const filtered = oldValue
+                  .split(' ')
+                  .filter((t) => t !== 'noopener' && t !== 'noreferrer')
+                  .join(' ');
+                const newValue = `${filtered} noopener noreferrer`.trim();
+                return fixer.replaceText(relAttr.value, `"${newValue}"`);
+              }
+              // No rel attribute — insert one before the closing >
               const sourceCode = context.sourceCode;
               const openTag = sourceCode.getText(node).match(/^<a[^>]*/)[0];
               const insertPos = node.range[0] + openTag.length;

tests/lib/rules/template-link-rel-noopener.js

@@ -6,12 +6,40 @@ const ruleTester = new RuleTester({
   parserOptions: { ecmaVersion: 2022, sourceType: 'module' },
 });
 ruleTester.run('template-link-rel-noopener', rule, {
-  valid: ['<template><a href="/" target="_blank" rel="noopener noreferrer">Link</a></template>'],
+  valid: [
+    '<template><a href="/" target="_blank" rel="noopener noreferrer">Link</a></template>',
+    // reversed order
+    '<template><a href="/" target="_blank" rel="noreferrer noopener">Link</a></template>',
+    // with additional values
+    '<template><a href="/" target="_blank" rel="nofollow noreferrer noopener">Link</a></template>',
+    // no target="_blank" means no rel required
+    '<template><a href="/">Link</a></template>',
+  ],
   invalid: [
+    // no rel attribute at all
     {
       code: '<template><a href="/" target="_blank">Link</a></template>',
       output: '<template><a href="/" target="_blank" rel="noopener noreferrer">Link</a></template>',
       errors: [{ messageId: 'missingRel' }],
     },
+    // rel="noopener" only — missing noreferrer
+    {
+      code: '<template><a href="/" target="_blank" rel="noopener">Link</a></template>',
+      output: '<template><a href="/" target="_blank" rel="noopener noreferrer">Link</a></template>',
+      errors: [{ messageId: 'missingRel' }],
+    },
+    // rel="noreferrer" only — missing noopener
+    {
+      code: '<template><a href="/" target="_blank" rel="noreferrer">Link</a></template>',
+      output: '<template><a href="/" target="_blank" rel="noopener noreferrer">Link</a></template>',
+      errors: [{ messageId: 'missingRel' }],
+    },
+    // rel="nofollow" — present but wrong values
+    {
+      code: '<template><a href="/" target="_blank" rel="nofollow">Link</a></template>',
+      output:
+        '<template><a href="/" target="_blank" rel="nofollow noopener noreferrer">Link</a></template>',
+      errors: [{ messageId: 'missingRel' }],
+    },
   ],
 });