KaTeX renders remote LaTeX with no maxSize/maxExpand limits #65

New Issue

2026-09-12T01:51:22-04:00

jared commented

2026-09-12 01:51:22 -04:00

Severity: low · Type: security · Confidence: high

Location: src/app/components/math/KaTeX.tsx:26-30, src/app/plugins/react-custom-html-parser.tsx:550-563

Problem

data-mx-maths on a <span>/<div> survives sanitization (src/app/utils/sanitize.ts:52,58)
and its value is handed verbatim to katex.renderToString with only throwOnError:false set. KaTeX's
maxSize defaults to Infinity and maxExpand to 1000, and trust defaults to false (so \href /
\url are correctly inert — no XSS here). But a remote sender can post
<span data-mx-maths="\rule{9999em}{9999em}"> or a deeply nested macro expansion and blow out the
timeline layout / burn CPU on every render of that message, in every client in the room.

How to trigger

send a formatted message whose formatted_body contains <span data-mx-maths="\rule{99999em}{99999em}">x</span>.

Suggested fix

pass { maxSize: 10, maxExpand: 100, trust: false, strict: 'ignore' } to
renderToString, and cap the accepted latex string length before rendering.

Filed from the September 2026 client audit (branch lotus @ 4bea4895).

**Severity:** low · **Type:** security · **Confidence:** high **Location:** `src/app/components/math/KaTeX.tsx:26-30`, `src/app/plugins/react-custom-html-parser.tsx:550-563` ### Problem `data-mx-maths` on a `<span>`/`<div>` survives sanitization (`src/app/utils/sanitize.ts:52,58`) and its value is handed verbatim to `katex.renderToString` with only `throwOnError:false` set. KaTeX's `maxSize` defaults to `Infinity` and `maxExpand` to 1000, and `trust` defaults to false (so `\href` / `\url` are correctly inert — no XSS here). But a remote sender can post `<span data-mx-maths="\rule{9999em}{9999em}">` or a deeply nested macro expansion and blow out the timeline layout / burn CPU on every render of that message, in every client in the room. ### How to trigger send a formatted message whose `formatted_body` contains `<span data-mx-maths="\rule{99999em}{99999em}">x</span>`. ### Suggested fix pass `{ maxSize: 10, maxExpand: 100, trust: false, strict: 'ignore' }` to `renderToString`, and cap the accepted `latex` string length before rendering. --- _Filed from the September 2026 client audit (branch `lotus` @ 4bea4895)._

jared added this to the Audit 2026-09 · Medium & Low milestone 2026-09-12 01:51:22 -04:00