Merge pull request #47 from roman-mibex-2/prevent-xss-in-svg-and-latex

Prevent XSS in Latex and SVG Elements

Author: jsvine

notebook.js

@@ -130,15 +130,15 @@
 
     nb.display.svg = function (svg) {
         var el = makeElement("div", [ "svg-output" ]);
-        el.innerHTML = joinText(svg);
+        el.innerHTML = nb.sanitizer(joinText(svg));
         return el;
     };
     nb.display["text/svg+xml"] = nb.display.svg;
     nb.display["image/svg+xml"] = nb.display.svg;
 
     nb.display.latex = function (latex) {
         var el = makeElement("div", [ "latex-output" ]);
-        el.innerHTML = joinText(latex);
+        el.innerText = joinText(latex).replace(/\n/g,"");
         return el;
     };
     nb.display["text/latex"] = nb.display.latex;