0 Members and 4 Guests are viewing this topic.
EEVblog's implementation of LaTex support using mathjax is currently unsafe and allows posters to inject arbitrary javascript. See https://www.eevblog.com/forum/chat/so-now-we-can-get-mathy-in-here/msg868990/#msg868990Can something be done about the security issue?
To enable safe mode, which prevents javascript in LaTex etc. you need to add ,Safe at the end of the full URL + parameters in the line in the header that invokes Mathjax.See http://mathjax.readthedocs.org/en/latest/safe-mode.html
<script type="text/javascript" async="async" src="https://cdn.mathjax.org/mathjax/latest/MathJax.js?config=TeX-AMS-MML_HTMLorMML,Safe"></script>
If you are still using it the way you set up here: https://www.eevblog.com/forum/suggestions/latex-for-eevblog/msg866703/#msg866703, just edit the custom script to insert the ,Safe immediately before the "> on the line with the mathjax URLCode: [Select]<script type="text/javascript" async="async" src="https://cdn.mathjax.org/mathjax/latest/MathJax.js?config=TeX-AMS-MML_HTMLorMML,Safe"></script>