Mattermost-server: KaTeX corrupts Webapp for incorrect syntax

[enuit]

Details have been omitted by the project administrator due to the nature of this issue, and transferred to an internal JIRA ticket.

https://mattermost.atlassian.net/browse/MM-9718

A fix has been released in Mattermost v4.7.3.

[octomike]

Details have been omitted by the project administrator due to the nature of this issue, and transferred to an internal JIRA ticket.

https://mattermost.atlassian.net/browse/MM-9718

A fix has been released in Mattermost v4.7.3.

[enuit]

Details have been omitted by the project administrator due to the nature of this issue, and transferred to an internal JIRA ticket.

https://mattermost.atlassian.net/browse/MM-9718

A fix has been released in Mattermost v4.7.3.

[jespino]

Hi, I'm investigating it. Looks like a problem with Katex. We are using throwOnError: false option, so It shouldn't raise a ParseError.

An example to make it fail is:

var katex = require('katex');
katex.renderToString('a_{x', {throwOnError: false, displayMode: true})

I going to read a bit of Katex code to try to find the problem.

[jespino]

After investigating a bit, looks like throwOnError is a confusing name, because only handle certain cases. Looks like we have to handle that kind of parse errors.

[lindy65]

Thanks @jespino !

[octomike]

Any recommendations for a quick fix?

[jespino]

@octomike The workaround would be, go to any channel (without latex text on it), go to your user settings > Advanced > Enable post formating, and disable it. Go to the channel with the bad formated latex, fix it (or delete the entire message). Then, back to your account settings, and re-enable the post formating.

[lindy65]

As the PR to fix this has been merged, I'll close off this issue here for now.

[amyblais]

Hello @enuit,

Thank you for reporting this issue!

We have included a fix for this issue you discovered in our 4.7.3 release, and would like to recognize you in our security research hall of fame and our upcoming security update email, which acknowledge those who help discover security issues.

We would also love to send you a Mattermost mug as a thank you. If you're interested, you can sign up to our public Mattermost instance at http://pre-release.mattermost.com/, and I can direct message you for contact details. Just let me know your username here if you've signed up.

[enuit]

Hey,
that would both be great.
My username in the chat is also enuit :)

[lindy65]

Thanks @enuit,

I've direct messaged you on http://pre-release.mattermost.com/ 👍