langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-22 04:25:29 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

There is a difference between direct replies and actual results of chatbot in chatflow #13905

New Issue
Closed
opened 2026-02-21 19:14:27 -05:00 by yindo · 7 comments
yindo commented 2026-02-21 19:14:27 -05:00
Owner
Copy Link
Copy Source

Originally created by @kongwulv on GitHub (May 15, 2025).

Self Checks

  • This is only for bug report, if you would like to ask a question, please head to Discussions.
  • I have searched for existing issues search for existing issues, including closed ones.
  • I confirm that I am using English to submit this report (我已阅读并同意 Language Policy).
  • [FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:)
  • Please do not modify this template :) and fill in all the required fields.

Dify version

latest

Cloud or Self Hosted

Self Hosted (Docker)

Steps to reproduce

Image

Image

✔️ Expected Behavior

Hyperlinks in chatbots and direct replies are consistent

❌ Actual Behavior

The onclick attribute of the hyperlink is lost

Originally created by @kongwulv on GitHub (May 15, 2025). ### Self Checks - [x] This is only for bug report, if you would like to ask a question, please head to [Discussions](https://github.com/langgenius/dify/discussions/categories/general). - [x] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones. - [x] I confirm that I am using English to submit this report (我已阅读并同意 [Language Policy](https://github.com/langgenius/dify/issues/1542)). - [x] [FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:) - [x] Please do not modify this template :) and fill in all the required fields. ### Dify version latest ### Cloud or Self Hosted Self Hosted (Docker) ### Steps to reproduce ![Image](https://github.com/user-attachments/assets/14a91ac7-c851-4c91-9bd0-135263c943fe) ![Image](https://github.com/user-attachments/assets/676b5706-5339-4c7e-8dc4-12a42ea5ef43) ### ✔️ Expected Behavior Hyperlinks in chatbots and direct replies are consistent ### ❌ Actual Behavior The onclick attribute of the hyperlink is lost
yindo closed this issue 2026-02-21 19:14:27 -05:00
yindo commented 2026-02-21 19:14:27 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (May 15, 2025):

Hello @kongwulv! I'm Dosu, your friendly bot here to help you solve bugs, answer questions, and assist you in becoming a contributor. I'm here while you wait for a human maintainer. Let’s tackle this together! 🚀

Dify's chatflow differentiates between direct replies and actual chatbot results using a question classification node. This node helps separate user needs, allowing direct replies for certain questions that don't require LLM processing, such as irrelevant questions or inquiries about joining the community [1].

Regarding the issue with the onclick attribute in hyperlinks, Dify has a known limitation where custom URL protocols in hyperlinks are converted to javascript:void(0), which means that JavaScript execution within HTML content in chat responses might not be supported [2]. This could be affecting the onclick functionality in your hyperlinks.

To continue talking to Dosu, mention @dosu.

Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other

@dosubot[bot] commented on GitHub (May 15, 2025): <!-- Greeting --> Hello @kongwulv! I'm [Dosu](https://dosu.dev), your friendly bot here to help you solve bugs, answer questions, and assist you in becoming a contributor. I'm here while you wait for a human maintainer. Let’s tackle this together! 🚀 <!-- Answer --> Dify's chatflow differentiates between direct replies and actual chatbot results using a question classification node. This node helps separate user needs, allowing direct replies for certain questions that don't require LLM processing, such as irrelevant questions or inquiries about joining the community <sup>[[1]](https://github.com/crazywoola/dify-docs-mintlify/blob/main/en/workshop/intermediate/customer-service-bot.mdx)</sup>. Regarding the issue with the `onclick` attribute in hyperlinks, Dify has a known limitation where custom URL protocols in hyperlinks are converted to `javascript:void(0)`, which means that JavaScript execution within HTML content in chat responses might not be supported <sup>[[2]](https://github.com/langgenius/dify/issues/12954)</sup>. This could be affecting the `onclick` functionality in your hyperlinks. <!-- Dosu Comment Footer --> *To continue talking to [Dosu](https://dosu.dev), mention @dosu.* --- <sup>Help Dosu learn! Give it feedback: [Great Response](https://app.dosu.dev/response-feedback/02c28f56-e6a2-43d1-b672-713942774a4e?feedback_type=great_response) | [Irrelevant Answer](https://app.dosu.dev/response-feedback/02c28f56-e6a2-43d1-b672-713942774a4e?feedback_type=irrelevant_answer) | [Incorrect Sources](https://app.dosu.dev/response-feedback/02c28f56-e6a2-43d1-b672-713942774a4e?feedback_type=incorrect_sources) | [Too Verbose](https://app.dosu.dev/response-feedback/02c28f56-e6a2-43d1-b672-713942774a4e?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/02c28f56-e6a2-43d1-b672-713942774a4e?feedback_type=hallucination) | [Bug Report](https://app.dosu.dev/response-feedback/02c28f56-e6a2-43d1-b672-713942774a4e?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/02c28f56-e6a2-43d1-b672-713942774a4e?feedback_type=other)</sup>
yindo commented 2026-02-21 19:14:28 -05:00
Author
Owner
Copy Link
Copy Source

@kongwulv commented on GitHub (May 15, 2025):

@dosu The onclick of the hyperlink is not the custom url protocol

@kongwulv commented on GitHub (May 15, 2025): @dosu The onclick of the hyperlink is not the custom url protocol
yindo commented 2026-02-21 19:14:28 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (May 15, 2025):

Dify's chatflow might still be affecting the onclick attribute due to its handling of HTML content and JavaScript execution. The platform applies strict Content Security Policies (CSP) that can block inline scripts and certain JavaScript functionalities to ensure security. This could result in the onclick attribute being stripped or not functioning as expected [1].

To continue talking to Dosu, mention @dosu.

Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other

@dosubot[bot] commented on GitHub (May 15, 2025): <!-- Answer --> Dify's chatflow might still be affecting the `onclick` attribute due to its handling of HTML content and JavaScript execution. The platform applies strict Content Security Policies (CSP) that can block inline scripts and certain JavaScript functionalities to ensure security. This could result in the `onclick` attribute being stripped or not functioning as expected <sup>[[1]](https://github.com/langgenius/dify/issues/17884)</sup>. <!-- Dosu Comment Footer --> *To continue talking to [Dosu](https://dosu.dev), mention @dosu.* --- <sup>Help Dosu learn! Give it feedback: [Great Response](https://app.dosu.dev/response-feedback/c70cde9e-9dd8-45e5-bfe3-d7081f83fa83?feedback_type=great_response) | [Irrelevant Answer](https://app.dosu.dev/response-feedback/c70cde9e-9dd8-45e5-bfe3-d7081f83fa83?feedback_type=irrelevant_answer) | [Incorrect Sources](https://app.dosu.dev/response-feedback/c70cde9e-9dd8-45e5-bfe3-d7081f83fa83?feedback_type=incorrect_sources) | [Too Verbose](https://app.dosu.dev/response-feedback/c70cde9e-9dd8-45e5-bfe3-d7081f83fa83?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/c70cde9e-9dd8-45e5-bfe3-d7081f83fa83?feedback_type=hallucination) | [Bug Report](https://app.dosu.dev/response-feedback/c70cde9e-9dd8-45e5-bfe3-d7081f83fa83?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/c70cde9e-9dd8-45e5-bfe3-d7081f83fa83?feedback_type=other)</sup>
yindo commented 2026-02-21 19:14:28 -05:00
Author
Owner
Copy Link
Copy Source

@kongwulv commented on GitHub (May 15, 2025):

@dosu How can I enable JavaScript functionality? And when I look at the streaming output in the console, the output is correct, and finally it turns into this form

@kongwulv commented on GitHub (May 15, 2025): @dosu How can I enable JavaScript functionality? And when I look at the streaming output in the console, the output is correct, and finally it turns into this form
yindo commented 2026-02-21 19:14:28 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (May 15, 2025):

Enabling JavaScript functionality within Dify's chatflow responses can be challenging due to the strict Content Security Policies (CSP) applied by the platform. These policies are designed to prevent XSS attacks and may block inline scripts or certain JavaScript functionalities. Currently, there is no documented method to modify or relax these CSP settings specifically for chatflow instances [1][2].

Regarding discrepancies between console output and final display, this can be caused by the use of 'if else' nodes in combination with answer nodes, which switches the streaming output to blocking mode at the last LLM node. Applying the patch from PR #12355 can help maintain normal streaming output [3].

To continue talking to Dosu, mention @dosu.

Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other

@dosubot[bot] commented on GitHub (May 15, 2025): <!-- Answer --> Enabling JavaScript functionality within Dify's chatflow responses can be challenging due to the strict Content Security Policies (CSP) applied by the platform. These policies are designed to prevent XSS attacks and may block inline scripts or certain JavaScript functionalities. Currently, there is no documented method to modify or relax these CSP settings specifically for chatflow instances <sup>[[1]](https://github.com/crazywoola/dify-docs-mintlify/blob/main/ja-jp/getting-started/install-self-hosted/environments.mdx)</sup><sup>[[2]](https://github.com/langgenius/dify/issues/18395)</sup>. Regarding discrepancies between console output and final display, this can be caused by the use of 'if else' nodes in combination with answer nodes, which switches the streaming output to blocking mode at the last LLM node. Applying the patch from PR #12355 can help maintain normal streaming output <sup>[[3]](https://github.com/langgenius/dify/issues/11985)</sup>. <!-- Dosu Comment Footer --> *To continue talking to [Dosu](https://dosu.dev), mention @dosu.* --- <sup>Help Dosu learn! Give it feedback: [Great Response](https://app.dosu.dev/response-feedback/4d905379-5cb9-4aaa-ab9a-eb3e14419876?feedback_type=great_response) | [Irrelevant Answer](https://app.dosu.dev/response-feedback/4d905379-5cb9-4aaa-ab9a-eb3e14419876?feedback_type=irrelevant_answer) | [Incorrect Sources](https://app.dosu.dev/response-feedback/4d905379-5cb9-4aaa-ab9a-eb3e14419876?feedback_type=incorrect_sources) | [Too Verbose](https://app.dosu.dev/response-feedback/4d905379-5cb9-4aaa-ab9a-eb3e14419876?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/4d905379-5cb9-4aaa-ab9a-eb3e14419876?feedback_type=hallucination) | [Bug Report](https://app.dosu.dev/response-feedback/4d905379-5cb9-4aaa-ab9a-eb3e14419876?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/4d905379-5cb9-4aaa-ab9a-eb3e14419876?feedback_type=other)</sup>
yindo commented 2026-02-21 19:14:28 -05:00
Author
Owner
Copy Link
Copy Source

@kongwulv commented on GitHub (May 16, 2025):

Is the target attribute of the hyperlink also controlled? @dosu

@kongwulv commented on GitHub (May 16, 2025): Is the target attribute of the hyperlink also controlled? @dosu
yindo commented 2026-02-21 19:14:28 -05:00
Author
Owner
Copy Link
Copy Source

@crazywoola commented on GitHub (May 30, 2025):

We’ve disabled certain potentially dangerous operations, such as onclick, for security reasons. We also handle link navigation through our own frontend logic, rather than relying on raw event handlers.

@crazywoola commented on GitHub (May 30, 2025): We’ve disabled certain potentially dangerous operations, such as onclick, for security reasons. We also handle link navigation through our own frontend logic, rather than relying on raw event handlers.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#13905
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?