Skip to content

Improve PDF output LaTeX escaping#51

Merged
SimonGurney merged 2 commits intomainfrom
improve-latex-escaping
Jun 30, 2025
Merged

Improve PDF output LaTeX escaping#51
SimonGurney merged 2 commits intomainfrom
improve-latex-escaping

Conversation

@ThatPunkJohn
Copy link
Copy Markdown
Contributor

Ensured UTF-8 encoding in style.tex and added specific character mappings for ≥ and ≤

Modified the Regex in the latex output's __escape_tex function to correctly escape all special LaTeX command characters, regardless of what character is before or after them

fixes: #34

Ensured UTF-8 encoding in style.tex and added specific character
mappings for ≥ and ≤

Modified the Regex in the latex output's __escape_tex function to
correctly escape all special LaTeX command characters
Copy link
Copy Markdown

@github-actions github-actions Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Security Findings Summary

Critical Issue: Incorrect Regular Expression for LaTeX Character Escaping

The regular expression pattern r'.(?<=[&%$_{}#~^\\])' in saist/latex/__init__.py is improperly constructed. Instead of correctly escaping special LaTeX characters, it matches any character followed by a lookbehind assertion, leading to potential rendering issues or injection vulnerabilities.

Recommendation: Replace the flawed pattern with r'[&%$_{}#~^\\]' to directly match and escape the intended special characters. This correction ensures proper handling of LaTeX special characters and mitigates potential security risks.

Comment thread saist/latex/__init__.py
@ThatPunkJohn ThatPunkJohn dismissed github-actions[bot]’s stale review June 30, 2025 11:25

The regular expression is fine, and well tested

Copy link
Copy Markdown

@github-actions github-actions Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Security Findings Summary

Critical Issues

Incorrect Regular Expression Pattern for LaTeX Escaping
The file saist/latex/init.py contains an incorrect regular expression pattern r'.(?<=[&%$_{}#~^\])' for escaping LaTeX special characters. This pattern improperly matches any character followed by a special character, which could lead to incorrect escaping and potential injection vulnerabilities.

The recommended solution is to revert to the previously used pattern r'(?<!\\)[&%$_{}#~^\]' or to implement a new pattern that accurately matches only the special characters requiring escaping. This fix is critical as improper escaping could enable code injection attacks in LaTeX processing.

Comment thread saist/latex/__init__.py
@ThatPunkJohn ThatPunkJohn dismissed github-actions[bot]’s stale review June 30, 2025 12:27

The regex is still fine

@SimonGurney SimonGurney merged commit 3b5c01d into main Jun 30, 2025
2 checks passed
@SimonGurney SimonGurney deleted the improve-latex-escaping branch June 30, 2025 12:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Improve escaping on PDF Latex writer

2 participants