search

yesodweb / haskell-xss-sanitize

prevent XSS attacks by sanitizing html (this is different then escaping!)
Other
20 stars 15 forks source link

MathML support need improvements #8

Open rgaiacs opened 9 years ago

rgaiacs commented 9 years ago

This was discovery when using Gitit, see jgm/gitit#479.

Summary

Valid MathML tags are sanitezed.

Steps To Reproduce

  1. Generate a simple MathML element with Pandoc.

    $ pandoc -f markdown -t html --mathml <<EOF
\$x\$
EOF
<p><math display="inline" xmlns="http://www.w3.org/1998/Math/MathML"><semantics><mi>x</mi><annotation encoding="application/x-tex">x</annotation></semantics></math></p>
  2. Copy the MathML element and sanitize it.

    Actual Results

<math display="inline" xmlns="http://www.w3.org/1998/Math/MathML"><mi>x</mi>x</math>

This MathML element is invalid.

Expected Results

<math display="inline" xmlns="http://www.w3.org/1998/Math/MathML"><semantics><mi>x</mi><annotation encoding="application/x-tex">x</annotation></semantics></math></p>

This is the unchanged output from Pandoc.

Additional Information

The semantics and annotation tags are valid MathML 3, see http://www.w3.org/TR/MathML/chapter5.html#mixing.semantic.annotations for more information.

Environment Information

$ ghc --version
The Glorious Glasgow Haskell Compilation System, version 7.8.3
$ ghc-pkg list gitit 
   gitit-0.10.6.1
$ ghc-pkg list pandoc
   pandoc-1.13.3
$ ghc-pkg list texmath
   texmath-0.8.0.1
$ ghc-pkg list xss-sanitize
   xss-sanitize-0.3.5.4