qti 2.12.1 → 2.13.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0f9b01aa2a3dd926eecc38def85058a183d1cdc137e7b2fdb7e57e53d039ec8d
-  data.tar.gz: 947616c8831529af2441ff21f24202be5a09a0edf14ed285576840c595019e25
+  metadata.gz: 012e43c78ded5cf4f1ec586f8bbd321cadb532facc73e3b06bf9ecd884ab724f
+  data.tar.gz: d95a01adb90683fa13c2bd769581edc53771c8a8157c692954090d38936fc318
 SHA512:
-  metadata.gz: 56801239a3801104cf1f79bd485fbeb45485b694360d4f2e98cc1edeaa3945b3c5aa85ccc9cdf282d5ee8657dc55b70731087cce0b65749fc9b12cf2c583819d
-  data.tar.gz: 9aee853c6af495ae4349aec0f429b17ec8d61cf46c952d5b96f92f63d0b6e5334332bd56249106c7df616fac44d7e4d0be9a28da4abff65528c22fa82029ede4
+  metadata.gz: bfd79edf504cedad28c37fb5c34ce67b54e2421ba8db324e25d905d23881c66d44f64f700d6803c8853f70b68864f249eb9725d47b3f3b232c66d3a9b2217f39
+  data.tar.gz: 197b13f906c3604df179ab2276d69fcd8e0183f8988046bcd73df35653c312c02f0e37127874d6d371d7320e7e9d0b2bea5a6bbc324d419d1c3067907fa8e1d9

data/lib/qti/sanitizer.rb

@@ -10,11 +10,15 @@ module Qti
 
     PROTOCOLS = ['http', 'https', :relative].freeze
     FILTER_TAGS = %w[iframe object embed video audio source].freeze
+    ALL_DATA_ATTR = [:data].freeze
     MEDIA_SRC_ATTR = %w[src data type codebase].freeze
     MEDIA_FMT_ATTR = %w[width height classid].freeze
     MEDIA_ALT_ATTR = %w[title alt allow allowfullscreen].freeze
-    MEDIA_EXT_ATTR = %w[data-media-type data-media-id].freeze
-    MEDIA_ATTR = [MEDIA_SRC_ATTR, MEDIA_FMT_ATTR, MEDIA_ALT_ATTR, MEDIA_EXT_ATTR].flatten.freeze
+    MEDIA_ATTR = [MEDIA_SRC_ATTR, MEDIA_FMT_ATTR, MEDIA_ALT_ATTR, ALL_DATA_ATTR].flatten.freeze
+
+    def self.relaxed_config(element, overrides)
+      Sanitize::Config::RELAXED[:attributes][element] + overrides
+    end
 
     CONFIG =
       {
@@ -38,7 +42,9 @@ module Qti
                           allowscriptaccess width height],
             'iframe' => %w[src width height name align frameborder scrolling sandbox
                            allowfullscreen webkitallowfullscreen mozallowfullscreen
-                           allow] # TODO: remove explicit allow with domain whitelist account setting
+                           allow] + ALL_DATA_ATTR, # TODO: remove explicit allow with domain whitelist account setting
+            'a' => relaxed_config('a', ['target'] + ALL_DATA_ATTR),
+            'img' => relaxed_config('img', ALL_DATA_ATTR)
           }
       }.freeze
 

data/lib/qti/version.rb

@@ -1,3 +1,3 @@
 module Qti
-  VERSION = '2.12.1'.freeze
+  VERSION = '2.13.1'.freeze
 end

data/spec/lib/qti/sanitizer_spec.rb

@@ -31,13 +31,6 @@ describe Qti::Sanitizer do
       expect(sanitizer.clean(html)).to include 'classid'
     end
 
-    it 'allows needed media extension attributes' do
-      html = '<object data-media-type="thing" data-media-id=123456789>'
-
-      expect(sanitizer.clean(html)).to include 'data-media-type'
-      expect(sanitizer.clean(html)).to include 'data-media-id'
-    end
-
     it 'allows needed media alt attributes' do
       html = '<source title="Title" alt="description" allow="fullscreen" allowfullscreen=1>'
 
@@ -46,5 +39,20 @@ describe Qti::Sanitizer do
       expect(sanitizer.clean(html)).to include 'allow'
       expect(sanitizer.clean(html)).to include 'allowfullscreen'
     end
+
+    it 'allows data attributes on <img>, <object>, <video>, <audio>, <iframe>, <source>, <a>' do
+      %w[<img> <object> <video> <audio> <iframe> <source> <a>].each do |tag|
+        tag.insert(-2, ' data-test="thing" data-media-id=123456789')
+
+        expect(sanitizer.clean(tag)).to include 'data-test'
+        expect(sanitizer.clean(tag)).to include 'data-media-id'
+      end
+    end
+
+    it 'allows target attribute on <a>' do
+      html = '<a href="http://a.url" target="_blank">'
+
+      expect(sanitizer.clean(html)).to include 'target="_blank"'
+    end
   end
 end

data/spec/lib/qti/v1/models/assessment_item_spec.rb

@@ -36,11 +36,11 @@ describe Qti::V1::Models::AssessmentItem do
       expect(loaded_class.item_body).to include '\(sample equation\)'
     end
 
-    it 'does not transform math content when conversion is Disabled' do
+    it 'does not replace <img> math content with pure latex when conversion is Disabled' do
       Qti.configure do |config|
         config.extract_latex_from_image_tags = false
       end
-      expect(loaded_class.item_body).not_to include '"sample equation"'
+      expect(loaded_class.item_body).to include '<img data-equation-content="sample equation"'
     end
 
     describe '#points_possible' do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: qti
 version: !ruby/object:Gem::Version
-  version: 2.12.1
+  version: 2.13.1
 platform: ruby
 authors:
 - Adrian Diaz
@@ -12,7 +12,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-01-31 00:00:00.000000000 Z
+date: 2023-04-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: actionview