self-hosted/joplin
1
0
Fork 0
mirror of https://github.com/laurent22/joplin.git synced 2024-11-27 08:21:03 +02:00
Code Issues Releases Activity

Desktop: Security: Improve KaTeX error handling (#11207)

Browse Source
This commit is contained in:
Henry Heino 2024-10-15 08:37:15 -07:00 committed by GitHub
parent f9b1a32ae7
commit 591c458a4f
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 14 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
packages/app-cli/tests/MdToHtml.ts
View File

@ -352,4 +352,12 @@ describe('MdToHtml', () => {
expect(html).toContain('Inline</span>');
expect(html).toContain('Block</span>');
});
it('should sanitize KaTeX errors', async () => {
const markdown = '$\\a<svg>$';
const renderResult = await newTestMdToHtml().render(markdown, null, { bodyOnly: true });
// Should not contain the HTML in unsanitized form
expect(renderResult.html).not.toContain('<svg>');
});
});

14
packages/renderer/MdToHtml/rules/katex.ts
View File

@ -310,12 +310,6 @@ function renderToStringWithCache(latex: string, katexOptions: any) {
}
}
// eslint-disable-next-line @typescript-eslint/no-explicit-any -- Old code before rule was applied
function renderKatexError(latex: string, error: any): string {
console.error('Katex error for:', latex, error);
return `<div class="inline-code">${error.message}</div>`;
}
export default {
// eslint-disable-next-line @typescript-eslint/no-explicit-any -- Old code before rule was applied
plugin: function(markdownIt: any, options: RuleOptions) {
@ -329,6 +323,10 @@ export default {
katexOptions.macros = options.context.userData.__katex.macros;
katexOptions.trust = true;
const renderKatexError = (error: Error): string => {
return `<div class="inline-code">${markdownIt.utils.escapeHtml(error.message)}</div>`;
};
// set KaTeX as the renderer for markdown-it-simplemath
const katexInline = function(latex: string) {
katexOptions.displayMode = false;
@ -336,7 +334,7 @@ export default {
try {
outputHtml = renderToStringWithCache(latex, katexOptions);
} catch (error) {
outputHtml = renderKatexError(latex, error);
outputHtml = renderKatexError(error);
}
return `<span class="joplin-editable"><span class="joplin-source" data-joplin-language="katex" data-joplin-source-open="$" data-joplin-source-close="$">${markdownIt.utils.escapeHtml(latex)}</span>${outputHtml}</span>`;
};
@ -353,7 +351,7 @@ export default {
try {
outputHtml = renderToStringWithCache(latex, katexOptions);
} catch (error) {
outputHtml = renderKatexError(latex, error);
outputHtml = renderKatexError(error);
}
return `<div class="joplin-editable"><pre class="joplin-source" data-joplin-language="katex" data-joplin-source-open="$$&#10;" data-joplin-source-close="&#10;$$&#10;">${markdownIt.utils.escapeHtml(latex)}</pre>${outputHtml}</div>`;