Steps to recreate this bug:
-
admin -> settings -> required -> add new whitelist domain
-
ensure domain is whitelisted for oneboxing or whitelisting disabled for onebox
-
Paste link to URL from whitelisted domain.
-
Right click and inspect link created by onebox. rel=‘nofollow noopener’ will be present.