another XSS #30
Comments
zackw
added a commit
to zackw/markdown-it-katex
that referenced
this issue
Dec 3, 2022
By default, invoke KaTeX in ‘throwOnError:false‘ mode, so that it will produce _something_ from any input, and in particular, something which is guaranteed not to allow any live HTML tags through from the input. (Unless you are using ‘trust:true‘, in which case you presumably know what you are doing and why.) throwOnError:true mode can be re-enabled with plugin options, but then this plugin will **not** catch any exceptions that are thrown, leaving recovery up to a higher level. Since this is a significant behavior change, but one that is more likely to *fix* bugs in dependent programs than to introce them, the version number is now 2.1.0. Fixes waylonflinn#26, waylonflinn#30, and waylonflinn#7. I would like to thank @khrykin, poster of waylonflinn#7, for the idea that maybe the exception handlers inside this plugin should just be completely removed.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
\unicode{}also allows for XSS$\unicode{<img src=x onerror=alert(1)>}$The text was updated successfully, but these errors were encountered: