From 07e79c6585e0582fe71b427dddf9b0a0c3a84ca8 Mon Sep 17 00:00:00 2001
From: Daniel Kesberg <dkesberg@gmail.com>
Date: Wed, 25 Mar 2026 16:35:38 +0100
Subject: [PATCH 1/2] test: add target null checks

---
 tests/DOMParser/Marks/LinkTest.php | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/tests/DOMParser/Marks/LinkTest.php b/tests/DOMParser/Marks/LinkTest.php
index cb62a9773..28c543f54 100644
--- a/tests/DOMParser/Marks/LinkTest.php
+++ b/tests/DOMParser/Marks/LinkTest.php
@@ -26,6 +26,7 @@
                         'type' => 'link',
                         'attrs' => [
                             'href' => 'https://tiptap.dev',
+                            'target' => null,
                         ],
                     ],
                 ],
@@ -56,6 +57,7 @@
                         'attrs' => [
                             'href' => 'https://tiptap.dev',
                             'rel' => 'noopener',
+                            'target' => null,
                         ],
                     ],
                 ],
@@ -86,6 +88,7 @@
                         'attrs' => [
                             'href' => 'https://tiptap.dev',
                             'class' => 'tiptap',
+                            'target' => null,
                         ],
                     ],
                 ],
@@ -143,10 +146,10 @@ function getInvalidUrls()
     return [
         // A standard JavaScript protocol
         "javascript:alert(window.origin)",
-    
+
         // The protocol is not case sensitive
         "jAvAsCrIpT:alert(window.origin)",
-    
+
         // Characters \x01-\x20 are allowed before the protocol
         "\x00javascript:alert(window.origin)",
         "\x01javascript:alert(window.origin)",
@@ -180,12 +183,12 @@ function getInvalidUrls()
         "\x1djavascript:alert(window.origin)",
         "\x1ejavascript:alert(window.origin)",
         "\x1fjavascript:alert(window.origin)",
-    
+
         // Characters \x09,\x0a,\x0d are allowed inside the protocol
         "java\x09script:alert(window.origin)",
         "java\x0ascript:alert(window.origin)",
         "java\x0dscript:alert(window.origin)",
-    
+
         // Characters \x09,\x0a,\x0d are allowed after protocol name before the colon
         "javascript\x09:alert(window.origin)",
         "javascript\x0a:alert(window.origin)",

From 0544a391fadd42716d2b17e91c299a709f6e65d7 Mon Sep 17 00:00:00 2001
From: Daniel Kesberg <dkesberg@gmail.com>
Date: Wed, 25 Mar 2026 16:36:13 +0100
Subject: [PATCH 2/2] fix: initialize target as null when missing from the HTML

---
 src/Marks/Link.php | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/Marks/Link.php b/src/Marks/Link.php
index 37ee0f3fd..c148b2be7 100644
--- a/src/Marks/Link.php
+++ b/src/Marks/Link.php
@@ -56,7 +56,9 @@ public function parseHTML()
                         return false;
                     }
 
-                    return null;
+                    return [
+                        'target' => $DOMNode->getAttribute('target') ?: null,
+                    ];
                 },
             ],
         ];