enhancement request - sanitize <script> tags in MathJax

[trevor]

Sorry if I'm missing the obvious way to do this:

I'd like to sanitize input between the MathJax markers such that script tags are not allowed. This seems relatively straightforward elsewhere in user-submitted kramdown content, but the MathJax tags appear to allow injection.

For instance:

$$ <script>alert('a')</script> <script>alert('b')</script> $$

is rendered as:

<script type="math/tex; mode=display">% <![CDATA[
 <script>alert('a')</script> <script>alert('b')</script>  %]]></script>

Which causes the second alert b to appear.

[gettalong]

Thanks for reporting this bug! This will be fixed in the next release.