[PR #13215] fix(ui): allow target and rel attributes on links in markdown #14559

Closed
opened 2026-02-16 18:19:20 -05:00 by yindo · 0 comments
Owner

Original Pull Request: https://github.com/anomalyco/opencode/pull/13215

State: closed
Merged: No


Fixes links in chat messages to open in new tabs.

Problem:
Links returned by the agent in chat messages were not opening in new tabs because DOMPurify was stripping the "target" and "rel" attributes from anchor tags during sanitization.

Root Cause:
The DOMPurify configuration in packages/ui/src/components/markdown.tsx didn't include "target" and "rel" in the allowed attributes list, even though the marked renderer was correctly adding target="_blank" and rel="noopener noreferrer" to links.

Fix:
Added ADD_ATTR: ["target", "rel"] to the DOMPurify config to preserve these attributes on anchor elements.

Testing:

  • Links in agent messages now open in new tabs
  • Security attributes (noopener noreferrer) are preserved
**Original Pull Request:** https://github.com/anomalyco/opencode/pull/13215 **State:** closed **Merged:** No --- Fixes links in chat messages to open in new tabs. **Problem:** Links returned by the agent in chat messages were not opening in new tabs because DOMPurify was stripping the "target" and "rel" attributes from anchor tags during sanitization. **Root Cause:** The DOMPurify configuration in packages/ui/src/components/markdown.tsx didn't include "target" and "rel" in the allowed attributes list, even though the marked renderer was correctly adding target="_blank" and rel="noopener noreferrer" to links. **Fix:** Added ADD_ATTR: ["target", "rel"] to the DOMPurify config to preserve these attributes on anchor elements. **Testing:** - Links in agent messages now open in new tabs - Security attributes (noopener noreferrer) are preserved
yindo added the pull-request label 2026-02-16 18:19:20 -05:00
yindo closed this issue 2026-02-16 18:19:20 -05:00
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#14559