Language: Java
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
        public void setAttributes(Node node, String tagName, Map<String, String> attributes) {
            if (node instanceof Link) {
                Link l = (Link) node;
                String destination = StringUtils.trimToEmpty(l.getDestination());
                var scheme = getScheme(destination);
                scheme.ifPresent(resolvedScheme -> {
                    if (!Set.of("http", "https").contains(resolvedScheme)) {
                        log.info("User tried to set an url with scheme {}, only http/https are accepted, href has been removed", resolvedScheme);
                        attributes.remove("href");
                    }
                });
                if (UrlUtils.isAbsoluteUrl(destination)) {
                    // accept only http or https protocols if we have an absolute link, else we override with an empty string
                    attributes.put("target", "_blank");
                    attributes.put("rel", "nofollow noopener noreferrer");
                    var newTabLabel = A11Y_NEW_TAB_LABEL.get();
                    if (newTabLabel != null) {
                        attributes.put("aria-label", ((Text)node.getFirstChild()).getLiteral() + " " + newTabLabel);
                    }
                }
            }
        }