MOBILE-4828 mathjax: Use ui/safe extension to prevent XSS

Author: dpalou

scripts/copy-assets.js

@@ -23,6 +23,7 @@ const ASSETS = {
     '/node_modules/mathjax/es5/input/mml/extensions': '/lib/mathjax/input/mml/extensions',
     '/node_modules/mathjax/es5/input/tex/extensions': '/lib/mathjax/input/tex/extensions',
     '/node_modules/mathjax/es5/output/chtml/fonts/woff-v2': '/lib/mathjax/output/chtml/fonts/woff-v2',
+    '/node_modules/mathjax/es5/ui/safe.js': '/lib/mathjax/ui/safe.js',
     '/node_modules/mp3-mediarecorder/dist/vmsg.wasm': '/lib/vmsg/vmsg.wasm',
     '/src/core/features/h5p/assets': '/lib/h5p',
     '/node_modules/ogv/dist': '/lib/ogv',

src/addons/filter/mathjaxloader/services/handlers/mathjaxloader.ts

@@ -49,13 +49,17 @@ export class AddonFilterMathJaxLoaderHandlerService extends CoreFilterDefaultHan
 
         // The MathJax configuration needs to be created before loading the MathJax script. Changing the options
         // after MathJax is initialized doesn't work (e.g. chaning window.MathJax.options or window.MathJax.config.options).
+        // @todo: Obtain mathjaxconfig from the site.
         this.window.MathJax = {
             options: {
                 enableMenu: false, // Disable right-click menu on equations.
             },
             startup: {
                 typeset: false, // Don't run typeset automatically on the whole page when MathJax is loaded.
             },
+            loader: {
+                load: ['ui/safe'], // Prevent XSS.
+            },
         };
 
         // Add the script to the header.