Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: htmlSanitize stripping away valid MML tags #900

Closed
wants to merge 1 commit into from

Conversation

icc
Copy link
Contributor

@icc icc commented Feb 15, 2024

Description

The DOMPurify dependency has been upgraded to the latest version.
The previous version is old and lack support for certain tags etc.
E.g. support for the mprescripts tag was added in 3.0.2

The newer version should be compatible with how DOMPurify is used today.

Steps to reproduce

Edit this MathML in e.g. CKEditor5:

<math xmlns="http://www.w3.org/1998/Math/MathML">
  <mmultiscripts>
    <msubsup>
      <mi>c</mi>
      <mi>h</mi>
      <mi>h</mi>
    </msubsup>
    <mprescripts/>
    <mi>h</mi>
    <mi>h</mi>
  </mmultiscripts>
</math>

and observe mprescripts tag is removed resulting in a different expression.

E.g. support for the mprescripts tag was added in DOMPurify 3.0.2
@icc
Copy link
Contributor Author

icc commented Feb 15, 2024

As a workaround until this is merged the parent project may override the dependency in package.json like this:

  "overrides": {
    "@wiris/mathtype-html-integration-devkit": {
      "dompurify": "^3.0.6"
    }
  }

@carla-at-wiris
Copy link
Contributor

Hi @icc, thank you for noticing the issue and proposing this solution!

We will send your proposal to the next step and once it's ready to release, we'll let you know! Any further issues, please feel free to contact us.

@carla-at-wiris
Copy link
Contributor

This solution has been included in our latest release. Check the following Pull Requests to see the changes related to it: #941 and #926.

Thank you for noticing the issue and taking the time to write the solution!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants