From dfbfc375dab443652f714c91ac4c88b054df6cea Mon Sep 17 00:00:00 2001
From: Nicolas Varrot <contact@nicolasvarrot.fr>
Date: Fri, 13 Feb 2026 04:42:39 +0000
Subject: [PATCH] fix: open external links in new tab with rel=noopener
 noreferrer

Markdown links pointing to external URLs (http/https) now open in a
new tab with target=_blank and rel='noopener noreferrer' for security.
Internal/relative links are unaffected.
---
 src/components/ChatMessage.tsx | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/src/components/ChatMessage.tsx b/src/components/ChatMessage.tsx
index 49f3515..c6acea9 100644
--- a/src/components/ChatMessage.tsx
+++ b/src/components/ChatMessage.tsx
@@ -150,7 +150,21 @@ function MarkdownImage(props: React.ImgHTMLAttributes<HTMLImageElement>) {
   return <ImageBlock src={props.src || ''} alt={props.alt} />;
 }
 
-const markdownComponents = { pre: CodeBlock, img: MarkdownImage };
+function MarkdownLink(props: React.AnchorHTMLAttributes<HTMLAnchorElement>) {
+  const { href, children, ...rest } = props;
+  const isExternal = href && /^https?:\/\//.test(href);
+  return (
+    <a
+      href={href}
+      {...(isExternal ? { target: '_blank', rel: 'noopener noreferrer' } : {})}
+      {...rest}
+    >
+      {children}
+    </a>
+  );
+}
+
+const markdownComponents = { pre: CodeBlock, img: MarkdownImage, a: MarkdownLink };
 
 function renderTextBlocks(blocks: MessageBlock[]) {
   return getTextBlocks(blocks).map((block, i) => (