From defd48b49cfd0ad04269c44a0e595ddd29316fde Mon Sep 17 00:00:00 2001
From: Glary-Bot <glary-bot@users.noreply.github.com>
Date: Fri, 22 May 2026 07:53:38 +0000
Subject: [PATCH] fix: add rel="noopener noreferrer" to privacy-policy links
 opened in new tab

Addresses CodeRabbit review on PR #12415. Hardens the three external privacy-policy anchors with target="_blank" to prevent the opened page from accessing window.opener.
---
 .../src/components/install/DesktopSettingsConfiguration.vue | 6 +++++-
 apps/desktop-ui/src/views/MetricsConsentView.vue            | 1 +
 src/components/dialog/content/SignInContent.vue             | 1 +
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/apps/desktop-ui/src/components/install/DesktopSettingsConfiguration.vue b/apps/desktop-ui/src/components/install/DesktopSettingsConfiguration.vue
index 095b7e1164..7f6629e3af 100644
--- a/apps/desktop-ui/src/components/install/DesktopSettingsConfiguration.vue
+++ b/apps/desktop-ui/src/components/install/DesktopSettingsConfiguration.vue
@@ -108,7 +108,11 @@
         </ul>
 
         <div class="mt-4">
-          <a href="https://comfy.org/privacy-policy" target="_blank">
+          <a
+            href="https://comfy.org/privacy-policy"
+            target="_blank"
+            rel="noopener noreferrer"
+          >
             {{ $t('install.settings.dataCollectionDialog.viewFullPolicy') }}
           </a>
         </div>
diff --git a/apps/desktop-ui/src/views/MetricsConsentView.vue b/apps/desktop-ui/src/views/MetricsConsentView.vue
index 39f1c2e77d..370f4c6d13 100644
--- a/apps/desktop-ui/src/views/MetricsConsentView.vue
+++ b/apps/desktop-ui/src/views/MetricsConsentView.vue
@@ -15,6 +15,7 @@
           <a
             href="https://comfy.org/privacy-policy"
             target="_blank"
+            rel="noopener noreferrer"
             class="text-blue-400 underline hover:text-blue-300"
           >
             {{ $t('install.privacyPolicy') }} </a
diff --git a/src/components/dialog/content/SignInContent.vue b/src/components/dialog/content/SignInContent.vue
index 8f15278ca0..85c360b229 100644
--- a/src/components/dialog/content/SignInContent.vue
+++ b/src/components/dialog/content/SignInContent.vue
@@ -128,6 +128,7 @@
         <a
           href="https://www.comfy.org/privacy-policy"
           target="_blank"
+          rel="noopener noreferrer"
           class="cursor-pointer text-blue-500"
         >
           {{ t('auth.login.privacyLink') }} </a