Conversation
Ensured UTF-8 encoding in style.tex and added specific character mappings for ≥ and ≤ Modified the Regex in the latex output's __escape_tex function to correctly escape all special LaTeX command characters
There was a problem hiding this comment.
Security Findings Summary
Critical Issue: Incorrect Regular Expression for LaTeX Character Escaping
The regular expression pattern r'.(?<=[&%$_{}#~^\\])' in saist/latex/__init__.py is improperly constructed. Instead of correctly escaping special LaTeX characters, it matches any character followed by a lookbehind assertion, leading to potential rendering issues or injection vulnerabilities.
Recommendation: Replace the flawed pattern with r'[&%$_{}#~^\\]' to directly match and escape the intended special characters. This correction ensures proper handling of LaTeX special characters and mitigates potential security risks.
The regular expression is fine, and well tested
There was a problem hiding this comment.
Security Findings Summary
Critical Issues
Incorrect Regular Expression Pattern for LaTeX Escaping
The file saist/latex/init.py contains an incorrect regular expression pattern r'.(?<=[&%$_{}#~^\])' for escaping LaTeX special characters. This pattern improperly matches any character followed by a special character, which could lead to incorrect escaping and potential injection vulnerabilities.
The recommended solution is to revert to the previously used pattern r'(?<!\\)[&%$_{}#~^\]' or to implement a new pattern that accurately matches only the special characters requiring escaping. This fix is critical as improper escaping could enable code injection attacks in LaTeX processing.
The regex is still fine
Ensured UTF-8 encoding in style.tex and added specific character mappings for ≥ and ≤
Modified the Regex in the latex output's __escape_tex function to correctly escape all special LaTeX command characters, regardless of what character is before or after them
fixes: #34