fix(markdown): unescape & last so math entities survive intact

The math pass unescaped & before < and >. mdToHtml escapes the source
first, so a literal "<" typed inside a formula arrives here as "<",
turns back into "<" on the ampersand pass, and is then eaten by the very next
one. Typing $a &lt; b$ rendered as "a < b" instead of the literal text.

The code-block pass in the same function already unescapes &amp; last; only the
math paths were the outlier, in all four of the copies this branch consolidated
into pushMath(). Reordering to match makes them consistent and clears the
js/double-escaping alert CodeQL raised on this PR.

Math containing a genuinely typed "<" is unaffected, which is why this went
unnoticed for so long. Covered by a regression test asserting both cases.

Author: o3LL

static/js/markdown.js

@@ -727,7 +727,10 @@ export function mdToHtml(src, opts) {
   // Typeset straight away when KaTeX is already in, otherwise bank the source in
   // an inert placeholder for renderMath() to swap once the library lands.
   const pushMath = (math, displayMode) => {
-    const raw = math.replace(/&amp;/g, '&').replace(/&lt;/g, '<').replace(/&gt;/g, '>').trim();
+    // Unescape &amp; LAST, matching the code-block pass above. Doing it first
+    // double-unescapes: a literal "&lt;" reaches here as "&amp;lt;", becomes
+    // "&lt;" on the & pass, and then collapses to "<" on the next one.
+    const raw = math.replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&amp;/g, '&').trim();
     const placeholder = `___MATH_BLOCK_${mathBlocks.length}___`;
     if (window.katex) {
       mathBlocks.push(katex.renderToString(raw, { displayMode, throwOnError: false }));

tests/test_markdown_lazy_lib_loading_js.py

@@ -292,6 +292,29 @@ def test_deferred_math_schedules_a_katex_load(node_available):
     assert out["scriptSrcs"] == [KATEX_SRC]
 
 
+def test_math_entities_are_not_double_unescaped(node_available):
+    """A literal "&lt;" in math must survive as "&lt;", not collapse to "<".
+
+    mdToHtml escapes the source before the math pass, so the user's "&lt;"
+    arrives as "&amp;lt;". Unescaping "&amp;" first turns it back into "&lt;"
+    and the very next pass eats it, which is the same double-unescape the
+    code-block pass already avoids by unescaping "&amp;" last.
+    """
+    out = _run_node(
+        """
+        globalThis.window.katex = { renderToString: (src) => `<K>${src}</K>` };
+        globalThis.katex = globalThis.window.katex;
+        emit({
+          entity: mod.mdToHtml('Math: $a &lt; b$ done.'),
+          realLt: mod.mdToHtml('Math: $a < b$ done.'),
+        });
+        """
+    )
+    assert "<K>a &lt; b</K>" in out["entity"]
+    # A genuinely typed "<" is untouched by the reorder.
+    assert "<K>a < b</K>" in out["realLt"]
+
+
 def test_md_to_html_renders_inline_once_katex_is_loaded(node_available):
     """After the first load mdToHtml goes back to typesetting synchronously."""
     out = _run_node(