Sanitize javascript: urls MathJax's \href macro can inject

MathJax's \href{url}{...} copies its argument into an <a href> with no
scheme check of its own. $\href{javascript:alert(1)}{click}$ rendered
into a live, clickable <a href="javascript:alert(1)"> in the DOM.
Confirmed this by rendering it and reading the resulting attribute,
not just from reading MathJax's source.

This predates the hover PR -- the same unguarded convertToTspans path
is already reachable today via axis/plot titles, annotations, and
non-hover legend text. Hover just became a new delivery surface for
it, since hover text more often comes from less-trusted per-point
data.

svg_text_utils.js already has an established fix for exactly this
shape of problem: sanitizeHref(), an http:/https:/mailto:/relative
allowlist, used for the pseudo-HTML <a href> tags in plain text.
sanitizeMathJaxLinks() applies the same allowlist to any <a> MathJax
produces, called once from convertToTspans right after the rendered
SVG is inserted. Since the fix lives in the shared function, it closes
the gap for titles/annotations/legends too, not just hover.

Added tests for both a hover label and a title with a javascript:
\href, confirming the link's href is stripped while a plain
\href{https://...}{...} keeps working.

Verified locally: `karma start test/jasmine/karma.conf.js
--bundleTest=mathjax_test.js --nowatch` -> 13 of 13 pass. Also ran the
full svg_text_utils/hover/legend/annotations/titles suite against
both this branch and unmodified main -- both show the same 8
pre-existing titles_test.js failures and the same intermittent "full
page reload" flakiness at random points in either case, confirming
neither is caused by this change.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: SergeyAxiomatic

src/lib/svg_text_utils.js

@@ -103,6 +103,24 @@ function positionMathGroup(_context, svgClass, mathjaxGroup, newSvg, textAnchor,
     });
 }
 
+/**
+ * Removes an unsafe href/xlink:href from every <a> MathJax's \href{url}{...}
+ * macro produced inside newSvg. MathJax copies the tex argument into the
+ * link verbatim, with no scheme check of its own.
+ *
+ * @param {d3 selection} newSvg: the typeset <svg>, already inserted into
+ *   the document (or a fragment), so selectAll can walk its descendants
+ */
+function sanitizeMathJaxLinks(newSvg) {
+    newSvg.selectAll('a').each(function() {
+        var a = d3.select(this);
+        ['href', 'xlink:href'].forEach(function(attrName) {
+            var href = a.attr(attrName);
+            if(href) a.attr(attrName, sanitizeHref(href) || null);
+        });
+    });
+}
+
 exports.convertToTspans = function(_context, gd, _callback) {
     var str = _context.text();
 
@@ -192,6 +210,13 @@ exports.convertToTspans = function(_context, gd, _callback) {
 
                 mathjaxGroup.node().appendChild(newSvg.node());
 
+                // MathJax's \href{url}{...} macro copies the url into an
+                // <a> verbatim, with no scheme check, so a javascript: url
+                // in tex source becomes a live, clickable XSS vector.
+                // Apply the same protocol allowlist used for pseudo-HTML
+                // <a href> tags elsewhere in this file (sanitizeHref).
+                sanitizeMathJaxLinks(newSvg);
+
                 // stitch the glyph defs
                 if(_glyphDefs && _glyphDefs.node()) {
                     newSvg.node().insertBefore(_glyphDefs.node().cloneNode(true),

test/jasmine/bundle_tests/mathjax_test.js

@@ -205,6 +205,28 @@ describe('Test MathJax v' + mathjaxVersion + ':', function() {
             })
             .then(done, done.fail);
         });
+
+        it('should strip a javascript: url from a tex \\href, but keep a safe one', function(done) {
+            Plotly.newPlot(gd, {
+                data: [{x: [1, 2, 3], y: [1, 2, 3]}],
+                layout: {
+                    title: {text: '$\\href{javascript:alert(1)}{unsafe}$'},
+                    xaxis: {title: {text: '$\\href{https://plotly.com}{safe}$'}}
+                }
+            })
+            .then(function() {
+                var gd3 = d3Select(gd);
+
+                var unsafeLink = gd3.select('.gtitle-math-group a');
+                expect(unsafeLink.size()).toBe(1, 'title link exists');
+                expect(unsafeLink.attr('href')).toBe(null, 'javascript: url stripped');
+
+                var safeLink = gd3.select('.g-xtitle .xtitle-math-group a');
+                expect(safeLink.size()).toBe(1, 'axis title link exists');
+                expect(safeLink.attr('href')).toBe('https://plotly.com', 'https: url kept');
+            })
+            .then(done, done.fail);
+        });
     });
 
     describe('Test hover tex rendering:', function() {
@@ -269,6 +291,40 @@ describe('Test MathJax v' + mathjaxVersion + ':', function() {
             .then(done, done.fail);
         });
 
+        it('should strip a javascript: url from a tex \\href in a hover label', function(done) {
+            Plotly.newPlot(gd, {
+                data: [{
+                    type: 'scatter',
+                    mode: 'markers',
+                    x: [1, 2, 3],
+                    y: [1, 2, 3],
+                    text: ['$\\href{javascript:alert(document.cookie)}{click me}$', 'b', 'c'],
+                    hoverinfo: 'text'
+                }],
+                layout: {
+                    width: 500,
+                    height: 400,
+                    margin: {l: 0, t: 0, r: 0, b: 0},
+                    xaxis: {range: [0, 4]},
+                    yaxis: {range: [0, 4]}
+                }
+            })
+            .then(function() {
+                _hover(125, 300);
+                return delay(30)();
+            })
+            .then(function() {
+                var gd3 = d3Select(gd);
+                var link = gd3.select('g.hovertext .nums-math-group a');
+
+                // MathJax still wraps the text in an <a>; only the
+                // javascript: url must be gone, not the tex rendering.
+                expect(link.size()).toBe(1, 'link exists');
+                expect(link.attr('href')).toBe(null, 'javascript: url stripped');
+            })
+            .then(done, done.fail);
+        });
+
         it('should leave a mixed tex/plain-text hover label as literal text', function(done) {
             Plotly.newPlot(gd, {
                 data: [{