Skip to content

Render hover labels through MathJax when the whole label is one tex expression #8051

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
SergeyAxiomatic wants to merge 6 commits into
base: main
Choose a base branch
from
Open

Render hover labels through MathJax when the whole label is one tex expression #8051

Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
29200a1
Render hover labels through MathJax when the whole label is one tex e…
SergeyAxiomatic Sep 17, 2026
4ef0e75
Fix the draftlog filename and link for PR #8051
SergeyAxiomatic Sep 17, 2026
704815a
Fix the new hover MathJax tests, not the reviewed fix itself
SergeyAxiomatic Sep 17, 2026
1e8ef5f
Address review: fix Fx.loneHover, share the math positioning code, ad…
SergeyAxiomatic Sep 18, 2026
39d42e4
Sanitize javascript: urls MathJax's \href macro can inject
SergeyAxiomatic Sep 18, 2026
dd5e7c7
Add XSS regression tests for annotations and legend text
SergeyAxiomatic Sep 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Add XSS regression tests for annotations and legend text 
sanitizeMathJaxLinks already covers these paths since it's applied
inside the shared convertToTspans, but only hover/title had explicit
coverage. Requested by @archmoj on PR #8051.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
  • Loading branch information
@SergeyAxiomatic @claude
SergeyAxiomatic and claude committed Sep 21, 2026
commit dd5e7c7b2837a7e20e86e409c3fe3089709a1d98
41 changes: 41 additions & 0 deletions test/jasmine/bundle_tests/mathjax_test.js
View file
Open in desktop
Comment thread
SergeyAxiomatic marked this conversation as resolved.
Original file line number Diff line number Diff line change
Expand Up @@ -227,6 +227,47 @@ describe('Test MathJax v' + mathjaxVersion + ':', function() {
})
.then(done, done.fail);
});

it('should strip a javascript: url from a tex \\href in an annotation', function(done) {
Plotly.newPlot(gd, {
data: [{x: [1, 2, 3], y: [1, 2, 3]}],
layout: {
annotations: [{
x: 2,
y: 2,
showarrow: false,
text: '$\\href{javascript:alert(1)}{unsafe}$'
}]
}
})
.then(function() {
var gd3 = d3Select(gd);
var link = gd3.select('.annotation-text-math-group a');

expect(link.size()).toBe(1, 'annotation link exists');
expect(link.attr('href')).toBe(null, 'javascript: url stripped');
})
.then(done, done.fail);
});

it('should strip a javascript: url from a tex \\href in non-hover legend text', function(done) {
Plotly.newPlot(gd, {
data: [{
x: [1, 2, 3],
y: [1, 2, 3],
name: '$\\href{javascript:alert(1)}{unsafe}$'
}],
layout: {showlegend: true}
})
.then(function() {
var gd3 = d3Select(gd);
var link = gd3.select('.legendtext-math-group a');

expect(link.size()).toBe(1, 'legend link exists');
expect(link.attr('href')).toBe(null, 'javascript: url stripped');
})
.then(done, done.fail);
});
});

describe('Test hover tex rendering:', function() {
Expand Down