MDL-81352 filter: Ensure equation safety prior to filtering

filter/mathjaxloader/filter.php

@@ -133,9 +133,13 @@ class filter_mathjaxloader extends moodle_text_filter {
 
         $hasdisplayorinline = false;
         if ($hasextra) {
+            // Convert the HTML tag wrapper inside the equation to entities.
+            $text = $this->escape_html_tag_wrapper($text);
             // If custom dilimeters are used, wrap whole text to prevent autolinking.
             $text = '<span class="nolink">' . $text . '</span>';
         } else if (preg_match('/\\\\[[(]/', $text) || preg_match('/\$\$/', $text)) {
+            // Convert the HTML tag wrapper inside the equation to entities.
+            $text = $this->escape_html_tag_wrapper($text);
             // Only parse the text if there are mathjax symbols in it. The recognized
             // math environments are \[ \] and $$ $$ for display mathematics and \( \)
             // for inline mathematics.
@@ -241,4 +245,20 @@ class filter_mathjaxloader extends moodle_text_filter {
                 $start,
                 $end - $start + 1);
     }
+
+    /**
+     * Escapes HTML tags within a string.
+     *
+     * This function replaces HTML tags enclosed in curly brackets with their respective HTML entities.
+     *
+     * @param string $text The input string containing HTML tags.
+     * @return string Returns the input string with HTML tags escaped.
+     */
+    private function escape_html_tag_wrapper(string $text): string {
+        return preg_replace_callback('/\{([^}]+)\}/', function(array $matches): string {
+            $search = ['<', '>'];
+            $replace = ['&lt;', '&gt;'];
+            return str_replace($search, $replace, $matches[0]);
+        }, $text);
+    }
 }