patrick/KaTeX
1
0
Fork 0
mirror of https://github.com/Smaug123/KaTeX synced 2025-10-09 13:08:40 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
293af2936de7c864c68c84f1be991899e15e58a0
KaTeX/website/versioned_docs/version-0.10.0-rc/security.md
ylemkimon 293af2936d Release v0.10.0-rc (#1634) 
* Release v0.10.0-rc

Bump master to v0.10.0-pre

* Update CHANGELOG.md

* Update SRI hashes

* Update SRI hashes
2018-08-20 00:25:11 +09:00

822 B
Raw Blame History

id, title, original_id
id title original_id
version-0.10.0-rc-security Security security

Any HTML generated by KaTeX should be safe from <script> or other code injection attacks.

Of course, it is always a good idea to sanitize the HTML, though you will need a rather generous whitelist (including some of SVG and MathML) to support all of KaTeX.

Use maxSize option for preventing large width/height visual affronts, use maxExpand for preventing infinite macro loop attacks, and use allowedProtocols for preventing certain protocols in \href. Please refer to Options for more details.

The error message thrown by KaTeX may contain unescaped LaTeX source code. See Handling Errors for more details.

If you discovered a security issue, please let us know via https://hackerone.com/khanacademy