Skip to content

Update safe extension to remove event listeners in MathML input #1548

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dpvc merged 2 commits into from
Aug 13, 2026
+35 −12
Merged

Update safe extension to remove event listeners in MathML input #1548

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a95f2a2
Update safe extension to remove event listeners in MathML input
dpvc Aug 9, 2026
7f3916c
Update ts/ui/safe/SafeMethods.ts
dpvc Aug 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 31 additions & 11 deletions ts/ui/safe/SafeMethods.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ export const SafeMethods: { [name: string]: FilterFunction<any, any, any> } = {
*
* @param {Safe<N,T,D>} safe The Safe object being used
* @param {string} url The URL being tested
* @returns {string|null} The URL if OK and null if not
* @returns {string|null} The URL if OK and null if not
*
* @template N The HTMLElement node class
* @template T The Text node class
Expand All @@ -55,7 +55,7 @@ export const SafeMethods: { [name: string]: FilterFunction<any, any, any> } = {
*
* @param {Safe<N,T,D>} safe The Safe object being used
* @param {string} list The class list being tested
* @returns {string|null} The class list if OK and null if not
* @returns {string|null} The class list if OK and null if not
*
* @template N The HTMLElement node class
* @template T The Text node class
Expand Down Expand Up @@ -94,7 +94,7 @@ export const SafeMethods: { [name: string]: FilterFunction<any, any, any> } = {
*
* @param {Safe<N,T,D>} safe The Safe object being used
* @param {string} id The id being tested
* @returns {string|null} The id if OK and null if not
* @returns {string|null} The id if OK and null if not
*
* @template N The HTMLElement node class
* @template T The Text node class
Expand All @@ -113,7 +113,7 @@ export const SafeMethods: { [name: string]: FilterFunction<any, any, any> } = {
*
* @param {Safe<N,T,D>} safe The Safe object being used
* @param {string} styles The style string being tested
* @returns {string} The sanitized style string
* @returns {string} The sanitized style string
*
* @template N The HTMLElement node class
* @template T The Text node class
Expand Down Expand Up @@ -166,7 +166,7 @@ export const SafeMethods: { [name: string]: FilterFunction<any, any, any> } = {
* @param {Safe<N,T,D>} safe The Safe object being used
* @param {string} style The style name being tested
* @param {N} div The temp DIV node containing the style object to be tested
* @returns {string|null} The sanitized style string or null if invalid
* @returns {string|null} The sanitized style string or null if invalid
*
* @template N The HTMLElement node class
* @template T The Text node class
Expand Down Expand Up @@ -201,7 +201,7 @@ export const SafeMethods: { [name: string]: FilterFunction<any, any, any> } = {
* @param {string} style The style name being tested
* @param {string} value The value of the style to test
* @param {N} div The temp DIV node containing the style object to be tested
* @returns {string|null} The sanitized style string or null if invalid
* @returns {string|null} The sanitized style string or null if invalid
*
* @template N The HTMLElement node class
* @template T The Text node class
Expand Down Expand Up @@ -238,7 +238,7 @@ export const SafeMethods: { [name: string]: FilterFunction<any, any, any> } = {
* @param {Safe<N,T,D>} safe The Safe object being used
* @param {string} style The style name being tested
* @param {string} value The value of the style to test
* @returns {string|null} The sanitized length value
* @returns {string|null} The sanitized length value
*
* @template N The HTMLElement node class
* @template T The Text node class
Expand All @@ -265,7 +265,7 @@ export const SafeMethods: { [name: string]: FilterFunction<any, any, any> } = {
*
* @param {Safe<N,T,D>} safe The Safe object being used
* @param {string} size The font size to test
* @returns {string|null} The sanitized style string or null if invalid
* @returns {string|null} The sanitized style string or null if invalid
*
* @template N The HTMLElement node class
* @template T The Text node class
Expand All @@ -280,7 +280,7 @@ export const SafeMethods: { [name: string]: FilterFunction<any, any, any> } = {
*
* @param {Safe<N,T,D>} safe The Safe object being used
* @param {string} size The script size multiplier to test
* @returns {string} The sanitized size
* @returns {string} The sanitized size
*
* @template N The HTMLElement node class
* @template T The Text node class
Expand All @@ -299,7 +299,7 @@ export const SafeMethods: { [name: string]: FilterFunction<any, any, any> } = {
*
* @param {Safe<N,T,D>} safe The Safe object being used
* @param {string} level The scriptlevel to test
* @returns {string|null} The sanitized scriptlevel or null
* @returns {string|null} The sanitized scriptlevel or null
*
* @template N The HTMLElement node class
* @template T The Text node class
Expand All @@ -319,7 +319,7 @@ export const SafeMethods: { [name: string]: FilterFunction<any, any, any> } = {
* @param {Safe<N,T,D>} safe The Safe object being used
* @param {string} value The attribute's value
* @param {string} id The attribute's id (e.g., data-mjx-variant)
* @returns {number|null} The sanitized value or null
* @returns {number|null} The sanitized value or null
*
* @template N The HTMLElement node class
* @template T The Text node class
Expand All @@ -332,4 +332,24 @@ export const SafeMethods: { [name: string]: FilterFunction<any, any, any> } = {
): string | null {
return id.match(safe.options.dataPattern) ? value : null;
},

/**
* Filter an on* attribute (don't allow them)
*
* @param {Safe<N,T,D>} _safe The Safe object being used
* @param {string} _value The attribute's value
* @param {string} _id The attribute's id (e.g., data-mjx-variant)
* @returns {string|null} The sanitized value or null
*
* @template N The HTMLElement node class
* @template T The Text node class
* @template D The Document class
*/
filterListeners<N, T, D>(
_safe: Safe<N, T, D>,
_value: string,
_id: string
): string | null {
return null;
},
};
5 changes: 4 additions & 1 deletion ts/ui/safe/safe.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -170,6 +170,7 @@ export class Safe<N, T, D> {
['scriptsizemultiplier', 'filterSizeMultiplier'],
['scriptlevel', 'filterScriptLevel'],
['data-', 'filterData'],
['on*', 'filterListeners'],
]);

/**
Expand Down Expand Up @@ -259,7 +260,9 @@ export class Safe<N, T, D> {
method ||
(id.substring(0, 5) === 'data-'
? this.filterAttributes.get('data-')
: null);
: id.substring(0, 2) === 'on'
? this.filterAttributes.get('on*')
: null);
if (!filter) {
return value;
}
Expand Down