From 4455904b4794dba8158a193e6392b51ec52a5952 Mon Sep 17 00:00:00 2001
From: sabraman <sabraman@yandex.ru>
Date: Mon, 13 Apr 2026 05:59:37 +0300
Subject: [PATCH] fix(web): add noopener to external markdown links

---
 apps/web/src/components/ChatMarkdown.test.tsx | 19 +++++++++++++++++++
 apps/web/src/components/ChatMarkdown.tsx      |  2 +-
 2 files changed, 20 insertions(+), 1 deletion(-)
 create mode 100644 apps/web/src/components/ChatMarkdown.test.tsx

diff --git a/apps/web/src/components/ChatMarkdown.test.tsx b/apps/web/src/components/ChatMarkdown.test.tsx
new file mode 100644
index 00000000..7bdbc601
--- /dev/null
+++ b/apps/web/src/components/ChatMarkdown.test.tsx
@@ -0,0 +1,19 @@
+import { renderToStaticMarkup } from "react-dom/server";
+import { describe, expect, it, vi } from "vitest";
+
+vi.mock("../hooks/useTheme", () => ({
+  useTheme: () => ({ theme: "light", setTheme: vi.fn(), resolvedTheme: "light" as const }),
+}));
+
+import ChatMarkdown from "./ChatMarkdown";
+
+describe("ChatMarkdown", () => {
+  it("adds noopener to external links opened in a new tab", () => {
+    const markup = renderToStaticMarkup(
+      <ChatMarkdown text="[docs](https://example.com/docs)" cwd={undefined} />,
+    );
+
+    expect(markup).toContain('target="_blank"');
+    expect(markup).toContain('rel="noopener noreferrer"');
+  });
+});
diff --git a/apps/web/src/components/ChatMarkdown.tsx b/apps/web/src/components/ChatMarkdown.tsx
index 9663d158..b364a8e3 100644
--- a/apps/web/src/components/ChatMarkdown.tsx
+++ b/apps/web/src/components/ChatMarkdown.tsx
@@ -243,7 +243,7 @@ function ChatMarkdown({ text, cwd, isStreaming = false }: ChatMarkdownProps) {
       a({ node: _node, href, ...props }) {
         const targetPath = resolveMarkdownFileLinkTarget(href, cwd);
         if (!targetPath) {
-          return <a {...props} href={href} target="_blank" rel="noreferrer" />;
+          return <a {...props} href={href} target="_blank" rel="noopener noreferrer" />;
         }
 
         return (