Issue Summary

A user is able to inject custom CSS even if commands like \style is disabled. The style gets rendered into the style attribute of the element containing the unicode character.

This occurs because the font-family is not correctly sanatized and only ' characters are escaped. Whatever is passed as the fontFamily gets shoved into the style attribute.

Steps to Reproduce

1. Go to any website that uses MathJax and allows the \unicode command.
2. Enter the following code into the parser \unicode[some-font; color:red; height: 100000px;]{x1234}.

Technical details

• MathJax Version: 3.2.2 (latest commit: 8565f9da973238e4c9571a86a4bcb281b1d98d9b)
• Client OS: Windows 10 Education 19045.3570
• Browser: Chrome 119.0.6045.123