moodle/moodle
3
0
Fork 0
mirror of https://github.com/moodle/moodle.git synced 2025-08-04 00:16:46 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

MDL-85152 filter_tex: Update deny list and slash handling

Browse source
This commit is contained in:
Michael Hawkins 2025-04-10 03:02:27 +08:00 • committed by Jun Pataleta
parent 1555c047b6
commit d115be943e
No known key found for this signature in database
GPG key ID: F83510526D99E2C7
1 changed files with 10 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

11
filter/tex/lib.php
View file

@ -84,11 +84,20 @@ function filter_tex_sanitize_formula(string $texexp): string {
'\afterassignment', '\expandafter', '\noexpand', '\special', '\afterassignment', '\expandafter', '\noexpand', '\special',
'\let', '\futurelet', '\else', '\fi', '\chardef', '\makeatletter', '\afterground', '\let', '\futurelet', '\else', '\fi', '\chardef', '\makeatletter', '\afterground',
'\noexpand', '\line', '\mathcode', '\item', '\section', '\mbox', '\declarerobustcommand', '\noexpand', '\line', '\mathcode', '\item', '\section', '\mbox', '\declarerobustcommand',
'\ExplSyntaxOn', '\pdffiledump', '\ExplSyntaxOn', '\pdffiledump', '\mathtex',
]; ];
$allowlist = ['inputenc']; $allowlist = ['inputenc'];
// Add encoded backslash (\) versions of backslashed items to deny list.
$encodedslashdenylist = array_map(function($value) {
$encoded = str_replace('\\', '\', $value);
// Return an encoded slash version if a slash is found, otherwise null so we can filter it off.
return $encoded != $value ? $encoded : null;
}, $denylist);
$encodedslashdenylist = array_filter($encodedslashdenylist);
$denylist = array_merge($denylist, $encodedslashdenylist);
// Prepare the denylist for regular expression. // Prepare the denylist for regular expression.
$denylist = array_map(function($value){ $denylist = array_map(function($value){
return '/' . preg_quote($value, '/') . '/i'; return '/' . preg_quote($value, '/') . '/i';