Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: error message XSS vulnerability #22

Merged
merged 1 commit into from
May 24, 2021
Merged

Conversation

catnose99
Copy link
Contributor

There is a XSS vulnerability around error handling.
Here are some examples.

$$"<img/src=./ onerror=alert(location)>
e^{i\theta} = i\sin\thetae^{i\theta}
$$
$$
e^{i\theta"<img/src=./ onerror=alert(location)>} = \cos\theta + i\sin\thetae^{i\theta} 
$$

I made a change to escape tex string.

Thank you!

@catnose99 catnose99 changed the title fix: error message XSS risk fix: error message XSS vulnerability Sep 21, 2020
@snoopysecurity
Copy link

Hey @goessner, any chance you could review this PR and fix this XSS issue?

@goessner
Copy link
Owner

Hi @catnose99 ... thanks for fixing that critical vulnerability ... sorry for lasting so long, to be able to get active here again.

--

sg

@goessner goessner merged commit 596f786 into goessner:master May 24, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants