From 8692935efa7ec91db8c16abdfd5469dea1a5b669 Mon Sep 17 00:00:00 2001 From: Michael Hawkins Date: Thu, 10 Apr 2025 03:02:27 +0800 Subject: [PATCH] MDL-85152 filter_tex: Update deny list and slash handling --- filter/tex/lib.php | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/filter/tex/lib.php b/filter/tex/lib.php index b95591bc091..a1d296ab9e4 100644 --- a/filter/tex/lib.php +++ b/filter/tex/lib.php @@ -84,11 +84,20 @@ function filter_tex_sanitize_formula(string $texexp): string { '\afterassignment', '\expandafter', '\noexpand', '\special', '\let', '\futurelet', '\else', '\fi', '\chardef', '\makeatletter', '\afterground', '\noexpand', '\line', '\mathcode', '\item', '\section', '\mbox', '\declarerobustcommand', - '\ExplSyntaxOn', '\pdffiledump', + '\ExplSyntaxOn', '\pdffiledump', '\mathtex', ]; $allowlist = ['inputenc']; + // Add encoded backslash (\) versions of backslashed items to deny list. + $encodedslashdenylist = array_map(function($value) { + $encoded = str_replace('\\', '\', $value); + // Return an encoded slash version if a slash is found, otherwise null so we can filter it off. + return $encoded != $value ? $encoded : null; + }, $denylist); + $encodedslashdenylist = array_filter($encodedslashdenylist); + $denylist = array_merge($denylist, $encodedslashdenylist); + // Prepare the denylist for regular expression. $denylist = array_map(function($value){ return '/' . preg_quote($value, '/') . '/i';