From 919a1a8125cbd0e44a5e6702c32f7ce3ac92bd81 Mon Sep 17 00:00:00 2001
From: Aleks Kissinger <aleks0@gmail.com>
Date: Sat, 10 Oct 2020 09:12:53 +0100
Subject: [PATCH] only allow code tags inside math tag

---
 src/Markdown.js | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/src/Markdown.js b/src/Markdown.js
index dc15e7d6b3..9914cff85a 100644
--- a/src/Markdown.js
+++ b/src/Markdown.js
@@ -18,14 +18,21 @@ import commonmark from 'commonmark';
 import {escape} from "lodash";
 import SdkConfig from './SdkConfig';
 
-const ALLOWED_HTML_TAGS = ['sub', 'sup', 'del', 'u', 'code'];
+const ALLOWED_HTML_TAGS = ['sub', 'sup', 'del', 'u'];
 
 // These types of node are definitely text
 const TEXT_NODES = ['text', 'softbreak', 'linebreak', 'paragraph', 'document'];
 
+function is_math_node(node) {
+    return node != null &&
+        node.literal != null &&
+        node.literal.match(/^<((div|span) data-mx-maths="[^"]*"|\/(div|span))>$/) != null;
+}
+
 function is_allowed_html_tag(node) {
     if (SdkConfig.get()['latex_maths'] &&
-        node.literal.match(/^<\/?(div|span)( data-mx-maths="[^"]*")?>$/) != null) {
+        (is_math_node(node) ||
+         (node.literal.match(/^<\/?code>$/) && is_math_node(node.parent)))) {
         return true;
     }