@wiris/mathtype-ckeditor5 7.31.0 → 8.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wiris/mathtype-ckeditor5",
-  "version": "7.31.0",
+  "version": "8.0.0",
   "description": "MathType Web for CKEditor5 editor",
   "keywords": [
     "chem",
@@ -32,13 +32,13 @@
   ],
   "main": "src/plugin.js",
   "scripts": {
-    "compile": "node ../../scripts/services/compile src/plugin.js ."
+    "build": "exit 0"
   },
   "dependencies": {
     "@ckeditor/ckeditor5-core": ">=23.0.0",
     "@ckeditor/ckeditor5-engine": ">=23.0.0",
     "@ckeditor/ckeditor5-ui": ">=23.0.0",
     "@ckeditor/ckeditor5-widget": ">=23.0.0",
-    "@wiris/mathtype-html-integration-devkit": "1.8.1"
+    "@wiris/mathtype-html-integration-devkit": "1.9.0"
   }
 }

package/src/plugin.js

@@ -256,6 +256,11 @@ export default class MathType extends Plugin {
       // And obtain the complete formula
       formula = `<math${mathAttributes}>${formula}</math>`;
 
+      // Skip if mathml contains a XSS injection
+      if (Util.containsXSS(formula)) {
+        return;
+      }
+
       /* Model node that contains what's going to actually be inserted. This can be either:
             - A <mathml> element with a formula attribute set to the given formula, or
             - If the original <math> had a LaTeX annotation, then the annotation surrounded by "$$...$$" */
@@ -324,7 +329,9 @@ export default class MathType extends Plugin {
 
       const mathUIElement = createViewImage(modelItem, { writer: viewWriter }); // eslint-disable-line no-use-before-define
 
-      viewWriter.insert(viewWriter.createPositionAt(widgetElement, 0), mathUIElement);
+      if (mathUIElement) {
+        viewWriter.insert(viewWriter.createPositionAt(widgetElement, 0), mathUIElement);
+      }
 
       return toWidget(widgetElement, viewWriter);
     }
@@ -339,9 +346,13 @@ export default class MathType extends Plugin {
       /* Although we use the HtmlDataProcessor to obtain the attributes,
             we must create a new EmptyElement which is independent of the
             DataProcessor being used by this editor instance */
-      return viewWriter.createEmptyElement('img', imgElement.getAttributes(), {
-        renderUnsafeAttributes: ['src'],
-      });
+      if (imgElement) {
+        return viewWriter.createEmptyElement('img', imgElement.getAttributes(), {
+          renderUnsafeAttributes: ['src'],
+        });
+      }
+
+      return null;
     }
 
     // Model -> Editing view