goessner / markdown-it-texmath

Support TeX math equations with your Markdown documents.
MIT License
161 stars 29 forks source link

fix: error message XSS vulnerability #22

Closed catnose99 closed 3 years ago

catnose99 commented 4 years ago

There is a XSS vulnerability around error handling. Here are some examples.

$$"<img/src=./ onerror=alert(location)>
e^{i\theta} = i\sin\thetae^{i\theta}
$$
$$
e^{i\theta"<img/src=./ onerror=alert(location)>} = \cos\theta + i\sin\thetae^{i\theta} 
$$

I made a change to escape tex string.

Thank you!

snoopysecurity commented 3 years ago

Hey @goessner, any chance you could review this PR and fix this XSS issue?

goessner commented 3 years ago

Hi @catnose99 ... thanks for fixing that critical vulnerability ... sorry for lasting so long, to be able to get active here again.

--

sg