Skip to content

fix(sanitize): prevent double user-content- prefix on footnote ids#563

Open
helloyou2012 wants to merge 1 commit into
vercel:mainfrom
helloyou2012:main
Open

fix(sanitize): prevent double user-content- prefix on footnote ids#563
helloyou2012 wants to merge 1 commit into
vercel:mainfrom
helloyou2012:main

Conversation

@helloyou2012

@helloyou2012 helloyou2012 commented Jul 22, 2026

Copy link
Copy Markdown

Footnote and heading ids were rendered with a doubled prefix (e.g. user-content-user-content-fn-1) because both remark-rehype and rehype-sanitize default their clobberPrefix to user-content-, so
the prefix was applied twice in the pipeline.

remark-rehype emits footnote backref hrefs (href="#fn-1") coordinated with its own clobberPrefix, so disabling the prefix upstream would desync hrefs from their targets and break footnote navigation. Disable clobberPrefix on rehype-sanitize instead, letting remark-rehype own the single, consistent prefixing of both hrefs and ids.

  • index.tsx: set clobberPrefix: "" on defaultSanitizeSchema
  • tests/footnotes.test.tsx: add regression test asserting footnote
    ids are prefixed exactly once
  • tests/allowed-tags.test.tsx: update assertions — user-provided
    ids on custom tags are no longer clobbered by sanitize

Description

Type of Change

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Documentation update
  • Performance improvement
  • Refactoring (no functional changes)

Related Issues

Fixes #
Closes #
Related to #

Changes Made

Testing

  • All existing tests pass
  • Added new tests for the changes
  • Manually tested the changes

Test Coverage

Screenshots/Demos

Checklist

  • My code follows the project's code style
  • I have performed a self-review of my own code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • My changes generate no new warnings or errors
  • I have added tests that prove my fix is effective or that my feature works
  • New and existing unit tests pass locally with my changes
  • I have created a changeset (pnpm changeset)

Changeset

  • I have created a changeset for these changes

Additional Notes

@helloyou2012
helloyou2012 force-pushed the main branch 2 times, most recently from 800daf0 to 734b81e Compare July 22, 2026 02:47
@helloyou2012 helloyou2012 changed the title fix(remarkRehype): prevent double user-content- prefix on footnote ids fix(sanitize): prevent double user-content- prefix on footnote ids Jul 22, 2026
Comment thread packages/streamdown/index.tsx
Footnote and heading ids were rendered with a doubled prefix (e.g.
`user-content-user-content-fn-1`) because both `remark-rehype` and
`rehype-sanitize` default their `clobberPrefix` to `user-content-`, so
the prefix was applied twice in the pipeline.

remark-rehype emits footnote backref hrefs (`href="#fn-1"`) coordinated
with its own `clobberPrefix`, so disabling the prefix upstream would
desync hrefs from their targets and break footnote navigation. Disable
`clobberPrefix` on rehype-sanitize instead, letting remark-rehype own
the single, consistent prefixing of both hrefs and ids.

- index.tsx: set `clobberPrefix: ""` on `defaultSanitizeSchema`
- __tests__/footnotes.test.tsx: add regression test asserting footnote
  ids are prefixed exactly once
- __tests__/allowed-tags.test.tsx: update assertions — user-provided
  ids on custom tags are no longer clobbered by sanitize
@helloyou2012

helloyou2012 commented Jul 22, 2026

Copy link
Copy Markdown
Author

Hi @haydenbleasel ! This PR fixes an issue where footnote links can't be navigated to.

Problem: Footnote definition elements have their id prefixed with user-content- twice
(id="user-content-user-content-fn-1"), while the backref link's href only gets the prefix once (#user-content-fn-1).
The href and target id no longer match, so clicking a footnote goes nowhere.

Root cause: Both remark-rehype and rehype-sanitize default their clobberPrefix to user-content-, and the two stages
stack, producing a doubled prefix on ids.

Fix: Disable clobberPrefix on rehype-sanitize so remark-rehype remains the single source of prefixing, keeping ids and
hrefs in sync.

Would appreciate a review — thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant