qti 2.13.0 → 2.13.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 59de2b4d33d7358a8024126e3b019dd75e59a4b9a27369bd5891144f5246b74b
-  data.tar.gz: b018ffb87e722f93f2301f98ca7d6611da87a2b92680347ae324e1a2f822cf72
+  metadata.gz: 012e43c78ded5cf4f1ec586f8bbd321cadb532facc73e3b06bf9ecd884ab724f
+  data.tar.gz: d95a01adb90683fa13c2bd769581edc53771c8a8157c692954090d38936fc318
 SHA512:
-  metadata.gz: f9f652bd1d7d18ca9797b76d104cd8353b2fc6936d58c4a1bc7e472acd94a698e19c106ad47db721797f25edae8829edfd9c3d03c0be78a949dfa2c72ff7426e
-  data.tar.gz: 8faf29357f3dadf3a3897b0a33baf2d6bf70e1666fae4f89191f89f94f16748c8361f4b7650e886795c9ae5f95d517de2a6dc6119b285073e654aa04dcb07176
+  metadata.gz: bfd79edf504cedad28c37fb5c34ce67b54e2421ba8db324e25d905d23881c66d44f64f700d6803c8853f70b68864f249eb9725d47b3f3b232c66d3a9b2217f39
+  data.tar.gz: 197b13f906c3604df179ab2276d69fcd8e0183f8988046bcd73df35653c312c02f0e37127874d6d371d7320e7e9d0b2bea5a6bbc324d419d1c3067907fa8e1d9

data/lib/qti/sanitizer.rb

@@ -10,11 +10,15 @@ module Qti
 
     PROTOCOLS = ['http', 'https', :relative].freeze
     FILTER_TAGS = %w[iframe object embed video audio source].freeze
+    ALL_DATA_ATTR = [:data].freeze
     MEDIA_SRC_ATTR = %w[src data type codebase].freeze
     MEDIA_FMT_ATTR = %w[width height classid].freeze
     MEDIA_ALT_ATTR = %w[title alt allow allowfullscreen].freeze
-    MEDIA_EXT_ATTR = %w[data-media-type data-media-id].freeze
-    MEDIA_ATTR = [MEDIA_SRC_ATTR, MEDIA_FMT_ATTR, MEDIA_ALT_ATTR, MEDIA_EXT_ATTR].flatten.freeze
+    MEDIA_ATTR = [MEDIA_SRC_ATTR, MEDIA_FMT_ATTR, MEDIA_ALT_ATTR, ALL_DATA_ATTR].flatten.freeze
+
+    def self.relaxed_config(element, overrides)
+      Sanitize::Config::RELAXED[:attributes][element] + overrides
+    end
 
     CONFIG =
       {
@@ -38,7 +42,9 @@ module Qti
                           allowscriptaccess width height],
             'iframe' => %w[src width height name align frameborder scrolling sandbox
                            allowfullscreen webkitallowfullscreen mozallowfullscreen
-                           allow] # TODO: remove explicit allow with domain whitelist account setting
+                           allow] + ALL_DATA_ATTR, # TODO: remove explicit allow with domain whitelist account setting
+            'a' => relaxed_config('a', ['target'] + ALL_DATA_ATTR),
+            'img' => relaxed_config('img', ALL_DATA_ATTR)
           }
       }.freeze
 

data/lib/qti/version.rb

@@ -1,3 +1,3 @@
 module Qti
-  VERSION = '2.13.0'.freeze
+  VERSION = '2.13.1'.freeze
 end

data/spec/lib/qti/sanitizer_spec.rb

@@ -31,13 +31,6 @@ describe Qti::Sanitizer do
       expect(sanitizer.clean(html)).to include 'classid'
     end
 
-    it 'allows needed media extension attributes' do
-      html = '<object data-media-type="thing" data-media-id=123456789>'
-
-      expect(sanitizer.clean(html)).to include 'data-media-type'
-      expect(sanitizer.clean(html)).to include 'data-media-id'
-    end
-
     it 'allows needed media alt attributes' do
       html = '<source title="Title" alt="description" allow="fullscreen" allowfullscreen=1>'
 
@@ -46,5 +39,20 @@ describe Qti::Sanitizer do
       expect(sanitizer.clean(html)).to include 'allow'
       expect(sanitizer.clean(html)).to include 'allowfullscreen'
     end
+
+    it 'allows data attributes on <img>, <object>, <video>, <audio>, <iframe>, <source>, <a>' do
+      %w[<img> <object> <video> <audio> <iframe> <source> <a>].each do |tag|
+        tag.insert(-2, ' data-test="thing" data-media-id=123456789')
+
+        expect(sanitizer.clean(tag)).to include 'data-test'
+        expect(sanitizer.clean(tag)).to include 'data-media-id'
+      end
+    end
+
+    it 'allows target attribute on <a>' do
+      html = '<a href="http://a.url" target="_blank">'
+
+      expect(sanitizer.clean(html)).to include 'target="_blank"'
+    end
   end
 end

data/spec/lib/qti/v1/models/assessment_item_spec.rb

@@ -36,11 +36,11 @@ describe Qti::V1::Models::AssessmentItem do
       expect(loaded_class.item_body).to include '\(sample equation\)'
     end
 
-    it 'does not transform math content when conversion is Disabled' do
+    it 'does not replace <img> math content with pure latex when conversion is Disabled' do
       Qti.configure do |config|
         config.extract_latex_from_image_tags = false
       end
-      expect(loaded_class.item_body).not_to include '"sample equation"'
+      expect(loaded_class.item_body).to include '<img data-equation-content="sample equation"'
     end
 
     describe '#points_possible' do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: qti
 version: !ruby/object:Gem::Version
-  version: 2.13.0
+  version: 2.13.1
 platform: ruby
 authors:
 - Adrian Diaz
@@ -12,7 +12,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-03-22 00:00:00.000000000 Z
+date: 2023-04-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: actionview