XSS via the Raw Macro

The raw macro allows inserting unfiltered HTML and other syntaxes.

Steps to reproduce:

1. Install the raw macro extension
2. (Optional) Switch to an unprivileged user
3. Edit the user profile
4. Add a raw macro with content <script>alert(1);</script> and syntax html/5.0 in the description.
5. Click "Save & View"

Expected result:

The text alert(1); is displayed in the description.

Actual result:

An alert with content "1" is displayed.

Note that this also affects the LaTeX export, by default, LaTeX is rendered with -shell-escape and the rendering is executed as root, therefore this allows root shell access in the docker container used for rendering. Depending on the setup of docker, this could provide ways to access local network resources that might not be properly secured and should make denial of service attacks way easier.