Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

web: sanitizer strips MathML <annotation>/<semantics> from rendered KaTeX — LaTeX source missing from DOM (copy-to-LaTeX tools broken)

未关闭 适合新手
  • 哪里不对？
#54,769 2 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

@Dante-dan 已经在做这个了。

开始于 2026年10月12日。

  • #54939 来自 @Dante-dan —— 未关闭

评估

难度
2/5
预计耗时
1-3 小时
新手友好度
77/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
typescript
领域
frontend

调研方向

阅读 packages/session-ui/src/components/markdown-cache.tsx，检查清理器配置中的 ADD_TAGS 列表。确认 MathML 输出在此处经过清理，然后检查更改后 annotation 及其 TeX 源码仍保留在 DOM 中；当基于 annotation 的复制工具能够读取源码，且渲染后的数学公式仍能正确显示时，即为完成。

由索引模型根据 Issue 内容生成。

描述

reproduced
Summary

In the web UI, rendered math looks correct, but the LaTeX source is absent from the DOM. KaTeX produces its default output (htmlAndMathml, i.e. HTML + MathML with <semantics><annotation encoding="application/x-tex">), but the HTML is passed through sanitizeMarkdown() before insertion, and the sanitizer's mathMl profile strips <semantics> / <annotation>. Consequences:

  • Browser extensions / userscripts that copy the original TeX (the KaTeX contrib/copy-tex ecosystem: "Copy LaTeX", "Formula Copy", etc.) cannot work on the web UI, while they work on katex.org / other chat UIs.
  • MathML semantics are lost for assistive technology and other DOM consumers.

Tested on OpenCode v2.0.25 (web UI, Chrome; served bundle _assets/markdown.worker-*.js contains marked + KaTeX 0.16.47). The same config is still present in dev.

Steps to reproduce

  1. Open the web UI, ask the model for a display formula, e.g.:

    $$
\begin{aligned}
(a+b)^3 &= (a+b)(a+b)^2 \\
&= a^3 + 3a^2 b + 3ab^2 + b^3 .
\end{aligned}
$$

  2. With the formulas rendered, run in DevTools console:

    document.querySelectorAll(".katex").length
// > 0 — math is rendered

document.querySelectorAll('annotation[encoding="application/x-tex"]').length
// 0 — but the LaTeX source is not in the DOM

  3. Or install any annotation-based copy extension (e.g. "Copy LaTeX (KaTeX & MathJax)"): it does nothing on OpenCode, while working on katex.org.

Expected

The DOM should retain KaTeX's MathML output, including <annotation encoding="application/x-tex"> with the original TeX (KaTeX's default behavior; what other AI chat UIs expose).

Actual

<semantics> and <annotation> are removed by sanitization. Visual rendering is unaffected (the HTML part is kept), so the loss is invisible until you try to copy a formula's source.

Root cause

  • packages/session-ui/src/components/markdown-cache.tsx:

    const config = {
  USE_PROFILES: { html: true, mathMl: true },
  SANITIZE_NAMED_PROPS: true,
  FORBID_TAGS: ["style"],
  FORBID_CONTENTS: ["style", "script"],
  ADD_TAGS: ["svg", "path"],
  ADD_ATTR: ["d", "viewBox", "preserveAspectRatio", "xmlns", "target"],
}

  • DOMPurify's built-in mathMl profile allowlist does not include semantics / annotation / annotation-xml, so the MathML annotation (and its encoding attribute) is dropped.

Suggested fix

Extend the allowlist (verified locally with the exact config above on doMPurify 3.4.16 — the annotation then survives sanitization and is queryable in the DOM):

-  ADD_TAGS: ["svg", "path"],
+  ADD_TAGS: ["svg", "path", "semantics", "annotation", "annotation-xml"],

No ADD_ATTR change is needed (encoding is already in DOMPurify's MathML attribute allowlist). The elements are plain text containers; allowing them carries no scripting risk.

Local verification (before/after)
  • Worker output: contains application/x-tex ✓
  • After sanitizeMarkdown config: annotation count = 0
  • After adding the three tags: annotation count = 1, <annotation encoding="application/x-tex">…</annotation> intact
主要语言
TypeScript
星标
221k
派生
29.6k
平均合并
4 小时 55 分钟
30 天内合并 PR
500

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

anomalyco/opencode 的其他 Issue

查看 anomalyco/opencode 的全部 Issue

相似的 Issue

更多 TypeScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。