Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

web: sanitizer strips MathML <annotation>/<semantics> from rendered KaTeX — LaTeX source missing from DOM (copy-to-LaTeX tools broken)

Open Beginner friendly
  • Is something wrong?
#54,769 2 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

@Dante-dan is already working on this.

Since Oct 12, 2026.

  • #54939 by @Dante-dan — open

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
77/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
typescript
Domain
frontend

Research direction

Read packages/session-ui/src/components/markdown-cache.tsx and inspect the sanitizer config’s ADD_TAGS list. Confirm the MathML output is sanitized there, then check that annotation and its TeX source remain in the DOM after the change; done when annotation based copy tools can read the source while rendered math still displays correctly.

Written by the indexing model from the issue text.

Description

reproduced
Summary

In the web UI, rendered math looks correct, but the LaTeX source is absent from the DOM. KaTeX produces its default output (htmlAndMathml, i.e. HTML + MathML with <semantics><annotation encoding="application/x-tex">), but the HTML is passed through sanitizeMarkdown() before insertion, and the sanitizer's mathMl profile strips <semantics> / <annotation>. Consequences:

  • Browser extensions / userscripts that copy the original TeX (the KaTeX contrib/copy-tex ecosystem: "Copy LaTeX", "Formula Copy", etc.) cannot work on the web UI, while they work on katex.org / other chat UIs.
  • MathML semantics are lost for assistive technology and other DOM consumers.

Tested on OpenCode v2.0.25 (web UI, Chrome; served bundle _assets/markdown.worker-*.js contains marked + KaTeX 0.16.47). The same config is still present in dev.

Steps to reproduce

  1. Open the web UI, ask the model for a display formula, e.g.:

    $$
\begin{aligned}
(a+b)^3 &= (a+b)(a+b)^2 \\
&= a^3 + 3a^2 b + 3ab^2 + b^3 .
\end{aligned}
$$

  2. With the formulas rendered, run in DevTools console:

    document.querySelectorAll(".katex").length
// > 0 — math is rendered

document.querySelectorAll('annotation[encoding="application/x-tex"]').length
// 0 — but the LaTeX source is not in the DOM

  3. Or install any annotation-based copy extension (e.g. "Copy LaTeX (KaTeX & MathJax)"): it does nothing on OpenCode, while working on katex.org.

Expected

The DOM should retain KaTeX's MathML output, including <annotation encoding="application/x-tex"> with the original TeX (KaTeX's default behavior; what other AI chat UIs expose).

Actual

<semantics> and <annotation> are removed by sanitization. Visual rendering is unaffected (the HTML part is kept), so the loss is invisible until you try to copy a formula's source.

Root cause

  • packages/session-ui/src/components/markdown-cache.tsx:

    const config = {
  USE_PROFILES: { html: true, mathMl: true },
  SANITIZE_NAMED_PROPS: true,
  FORBID_TAGS: ["style"],
  FORBID_CONTENTS: ["style", "script"],
  ADD_TAGS: ["svg", "path"],
  ADD_ATTR: ["d", "viewBox", "preserveAspectRatio", "xmlns", "target"],
}

  • DOMPurify's built-in mathMl profile allowlist does not include semantics / annotation / annotation-xml, so the MathML annotation (and its encoding attribute) is dropped.

Suggested fix

Extend the allowlist (verified locally with the exact config above on doMPurify 3.4.16 — the annotation then survives sanitization and is queryable in the DOM):

-  ADD_TAGS: ["svg", "path"],
+  ADD_TAGS: ["svg", "path", "semantics", "annotation", "annotation-xml"],

No ADD_ATTR change is needed (encoding is already in DOMPurify's MathML attribute allowlist). The elements are plain text containers; allowing them carries no scripting risk.

Local verification (before/after)
  • Worker output: contains application/x-tex ✓
  • After sanitizeMarkdown config: annotation count = 0
  • After adding the three tags: annotation count = 1, <annotation encoding="application/x-tex">…</annotation> intact
Dominant language
TypeScript
Stars
213k
Forks
28.4k
Avg merge
8h 32m
Merged PRs (30d)
253

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from anomalyco/opencode

All issues in anomalyco/opencode

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.