From 91ffbb5d0a9cd0c4760ee09e59f75f2355f6135c Mon Sep 17 00:00:00 2001
From: Jannis Braun <151788261+TheZwiss@users.noreply.github.com>
Date: Wed, 25 Mar 2026 03:15:54 +0100
Subject: [PATCH] fix: add noopener to window.open fallback in saveImage

---
 packages/web/src/utils/imageActions.test.ts | 2 +-
 packages/web/src/utils/imageActions.ts      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/packages/web/src/utils/imageActions.test.ts b/packages/web/src/utils/imageActions.test.ts
index 505accd5..10d2296d 100644
--- a/packages/web/src/utils/imageActions.test.ts
+++ b/packages/web/src/utils/imageActions.test.ts
@@ -57,7 +57,7 @@ describe('saveImage', () => {
 
     await saveImage('https://media.tenor.com/abc/tenor.gif');
 
-    expect(openSpy).toHaveBeenCalledWith('https://media.tenor.com/abc/tenor.gif', '_blank');
+    expect(openSpy).toHaveBeenCalledWith('https://media.tenor.com/abc/tenor.gif', '_blank', 'noopener');
     expect(mockAddToast).toHaveBeenCalledWith('Opened in new tab', 'info', 3000);
   });
 });
diff --git a/packages/web/src/utils/imageActions.ts b/packages/web/src/utils/imageActions.ts
index 833e0fd0..199179e7 100644
--- a/packages/web/src/utils/imageActions.ts
+++ b/packages/web/src/utils/imageActions.ts
@@ -20,7 +20,7 @@ export async function saveImage(url: string, filename?: string): Promise<void> {
     a.remove();
     URL.revokeObjectURL(blobUrl);
   } catch {
-    window.open(url, '_blank');
+    window.open(url, '_blank', 'noopener');
     useUIStore.getState().addToast('Opened in new tab', 'info', 3000);
   }
 }