From fd5258cb3c1a5d54de3e13c57de2a4a3462472fb Mon Sep 17 00:00:00 2001
From: Sam <sam.saffron@gmail.com>
Date: Fri, 17 Aug 2018 16:14:27 +1000
Subject: [PATCH] SECURITY: do not allow tags in math wrapper

---
 assets/javascripts/initializers/discourse-math.js.es6 | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/assets/javascripts/initializers/discourse-math.js.es6 b/assets/javascripts/initializers/discourse-math.js.es6
index 7d05f32..67336c3 100644
--- a/assets/javascripts/initializers/discourse-math.js.es6
+++ b/assets/javascripts/initializers/discourse-math.js.es6
@@ -52,14 +52,14 @@ function decorate(elem, isPreview) {
       `<${tag} style="display: none;"><script type="math/tex${display}"></script></${tag}>`
     );
     $math = $mathWrapper.children();
-    $math.html($elem.text());
+    $math.text($elem.text());
     $elem.after($mathWrapper);
   } else if ($elem.hasClass("asciimath")) {
     $mathWrapper = $(
       `<span style="display: none;"><script type="math/asciimath"></script></span>`
     );
     $math = $mathWrapper.children();
-    $math.html($elem.text());
+    $math.text($elem.text());
     $elem.after($mathWrapper);
   }