notes: mark links as nofollow.

app/logical/note_sanitizer.rb

@@ -59,6 +59,9 @@ module NoteSanitizer
       text,
       :elements => ALLOWED_ELEMENTS,
       :attributes => ALLOWED_ATTRIBUTES,
+      :add_attributes => {
+        "a" => { "rel" => "nofollow" },
+      },
       :protocols => {
         "a" => {
           "href" => ["http", "https", :relative]

test/unit/note_sanitizer_test.rb

@@ -16,5 +16,10 @@ class NoteSanitizerTest < ActiveSupport::TestCase
       body = '<p style="font-size: 1em;">test</p>'
       assert_equal('<p style="font-size: 1em;">test</p>', NoteSanitizer.sanitize(body))
     end
+
+    should "mark links as nofollow" do
+      body = '<a href="http://www.google.com">google</a>'
+      assert_equal('<a href="http://www.google.com" rel="nofollow">google</a>', NoteSanitizer.sanitize(body))
+    end
   end
 end