Skip to content

Conversation

rtibbles
Copy link
Member

Summary

  • In our QTI question generation on Studio for any formulae, we leverage the MathML semantics element to preserve the original LaTeX of the expression.
  • Unfortunately, DOMPurify santiizes out semantics elements due to XSS vulnerabilities associated with its annotation elements.
  • We allow the semantics element to be retained here, but don't allow the annotation elements to be preserved - this slightly messes with the point of preserving the LaTeX as an annotation, but if we do need it in future, we can do some more precise filtering to allow that through will still disallowing any other encoding.
  • Adds some basic styling for MathML.

References

Fixes #13667

Reviewer guidance

image

Import a survey with a free response question and formula content into Kolibri and observe that the formula is now properly renderered.

Open question - the alternative here is to just remove the annotation completely from the Studio side - I don't think allowing semantics in this way opens us up to an XSS, but we would have to do some extra work to specifically allow the LaTeX annotation to be retained during santization.

…ny child annotation elements still.

Add some basic styling for MathML.
@rtibbles
Copy link
Member Author

rtibbles commented Sep 5, 2025

Would be good to get QA verification here - I don't think the code is likely to change much.

@pcenov
Copy link
Member

pcenov commented Sep 8, 2025

@rtibbles which Studio environment should I be using to test this one, publishing a channel with a Survey with a Free response question is still not working properly at Hotfixes...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants