From 7448501c7cb0192e6f99b17ffb920ba836c9216a Mon Sep 17 00:00:00 2001
From: Alexey Pyltsyn <lex61rus@gmail.com>
Date: Fri, 22 May 2020 06:18:27 +0300
Subject: [PATCH] refactor(v2): make external links more secure (#2783)

---
 packages/docusaurus/src/client/exports/Link.tsx | 3 ++-
 website/docs/docusaurus-core.md                 | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/packages/docusaurus/src/client/exports/Link.tsx b/packages/docusaurus/src/client/exports/Link.tsx
index 7db5334d7a..4d35824895 100644
--- a/packages/docusaurus/src/client/exports/Link.tsx
+++ b/packages/docusaurus/src/client/exports/Link.tsx
@@ -85,8 +85,9 @@ function Link({isNavLink, ...props}: Props) {
   return !targetLink || !isInternal || targetLink.startsWith('#') ? (
     // eslint-disable-next-line jsx-a11y/anchor-has-content
     <a
-      {...(isInternal ? props : {target: '_blank', ...props})}
       href={targetLink}
+      {...(!isInternal && {target: '_blank', rel: 'noopener noreferrer'})}
+      {...props}
     />
   ) : (
     <LinkComponent
diff --git a/website/docs/docusaurus-core.md b/website/docs/docusaurus-core.md
index bae32ee471..92e54798ca 100644
--- a/website/docs/docusaurus-core.md
+++ b/website/docs/docusaurus-core.md
@@ -73,7 +73,7 @@ const Page = () => (
       Check out my <Link to="/blog">blog</Link>!
     </p>
     <p>
-      {/* Note that external links still use `a` tags. */}
+      {/* Note that external links still use `a` tags, but automatically opens in new tab. */}
       Follow me on <a href="https://twitter.com/docusaurus">Twitter</a>!
     </p>
   </div>