XSS when parsing math expression #26
Description
Look at: https://github.com/waylonflinn/markdown-it-katex/blob/master/index.js#L168
Once the parser returns error, it would return katex without sanitizing as HTML tags.
To trigger this catch block, you can easily put one more "%" character.
Try it on live demo http://waylonflinn.github.io/markdown-it-katex/
- Input the data as
$<img src=a onerror=alert(1)>$, nothing happens - Try
$<img src=a onerror=alert(1)>%$you can see the alert dialog.
Consider this affects many real-world products.