fix(markdown): Ensure abbr: links render correctly in react-markdown v9+ #20648
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
React-markdown v9 and later versions enforce stricter default URL filtering, which inadvertently removed support for custom URL schemes like 'abbr:'. This commit introduces a `customUrlTransform` function, now located in `markdown-utils.ts`. This function is passed to the `ReactMarkdown` component to: - Explicitly allow the 'abbr:' protocol. - Permit standard safe web protocols (http, https, mailto, xmpp, irc, ircs). - Allow page-local fragments (#), protocol-relative URLs (//), and all purely relative paths. - Disallow other potentially unsafe or unsupported URL schemes. This restores the intended functionality for 'abbr:' links while maintaining robust URL handling and security for the Markdown component.
crazywoola
approved these changes
Jun 4, 2025
jsincorporated
pushed a commit
to jsincorporated/asaAi
that referenced
this pull request
Jul 8, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #16243
Summary
In the early Dify version 0.15.3 (using react-markdown: "^8.0.6"), custom URL schemes like next advice and advice rendered as interactive links as intended. However, when later Dify versions upgraded to React-Markdown v9+, stricter default URL filtering (a security improvement) inadvertently removed support for schemes like abbr:. Consequently, these links no longer render interactively, impacting user experience.
This commit introduces a
customUrlTransformfunction, now strategically located inweb/app/components/base/markdown/markdown-utils.tsfor better code organization. This function is passed to theReactMarkdowncomponent'surlTransformprop.The
customUrlTransformfunction ensures that:undefined, promptingreact-markdownto remove the link orhrefattribute.This change restores the intended functionality for 'abbr:' links, allowing users to interact with them as designed, while maintaining robust URL handling and security for the Markdown rendering component. The solution is self-contained and does not rely on external dummy URLs for parsing, making it suitable for self-hosted deployments.
Screenshots
iShot_2025-06-04_18.07.46.mp4
Checklist
dev/reformat(backend) andcd web && npx lint-staged(frontend) to appease the lint gods