patrick/KaTeX
1
0
Fork 0
mirror of https://github.com/Smaug123/KaTeX synced 2025-10-05 19:28:39 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
c88fa70a629d47610dd16ad002acfd27810a70a4
KaTeX/docs/security.md
ylemkimon 702b3c807f Add Building from Source & update Security documentation (#1516) 
* Add `Building from Source` documentation

* Update security.md documentation

* Fix grammars
2018-07-30 03:18:44 +09:00

782 B
Raw Blame History

id, title
id title
security Security

Any HTML generated by KaTeX should be safe from <script> or other code injection attacks.

Of course, it is always a good idea to sanitize the HTML, though you will need a rather generous whitelist (including some of SVG and MathML) to support all of KaTeX.

Use maxSize option for preventing large width/height visual affronts, use maxExpand for preventing infinite macro loop attacks, and use allowedProtocols for preventing certain protocols in \href. Please refer to Options for more details.

The error message thrown by KaTeX may contain unescaped LaTeX source code. See Handling Errors for more details.

If you discovered a security issue, please let us know via https://hackerone.com/khanacademy