CVE-2020-9444: Prevent reverse tabnabbing attacks.

While we could fix this issue by changing the markdown processor,
doing so is not a robust solution, because even a momentary bug in the
markdown processor could allow cached messages that do not follow our
security policy.

This change ensures that even if our markdown processor has bugs that
result in rendered content that does not properly follow our policy of
using rel="noopener noreferrer" on links, we'll still do something
reasonable.

Co-authored-by: Tim Abbott <tabbott@zulipchat.com>
Signed-off-by: Anders Kaseorg <anders@zulipchat.com>

static/js/templates.js

@@ -1,3 +1,5 @@
+const util = require("./util");
+
 // Below, we register Zulip-specific extensions to the handlebars API.
 //
 // IMPORTANT: When adding a new handlebars helper, update the
@@ -87,4 +89,9 @@ Handlebars.registerHelper('tr', function (context, options) {
     return new Handlebars.SafeString(result);
 });
 
+Handlebars.registerHelper(
+    "rendered_markdown",
+    content => new Handlebars.SafeString(util.clean_user_content_links(content))
+);
+
 window.templates = exports;