Skip to content
Permalink
v2.2-latest
Switch branches/tags
Go to file
 
 
Cannot retrieve contributors at this time
/* -*- Mode: Javascript; indent-tabs-mode:nil; js-indent-level: 2 -*- */
/* vim: set ts=2 et sw=2 tw=80: */
/*************************************************************
*
* MathJax/extensions/Safe.js
*
* Implements a "Safe" mode that disables features that could be
* misused in a shared environment (such as href's to javascript URL's).
* See the CONFIG variable below for configuration options.
*
* ---------------------------------------------------------------------
*
* Copyright (c) 2013 The MathJax Consortium
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
(function (HUB,AJAX) {
var VERSION = "2.2";
var CONFIG = MathJax.Hub.CombineConfig("Safe",{
allow: {
//
// Values can be "all", "safe", or "none"
//
URLs: "safe", // safe are in safeProtocols below
classes: "safe", // safe start with MJX-
cssIDs: "safe", // safe start with MJX-
styles: "safe", // safe are in safeStyles below
fontsize: "all", // safe are between sizeMin and sizeMax em's
require: "safe" // safe are in safeRequire below
},
sizeMin: .7, // \scriptsize
sizeMax: 1.44, // \large
safeProtocols: {
http: true,
https: true,
file: true,
javascript: false
},
safeStyles: {
color: true,
backgroundColor: true,
border: true,
cursor: true,
margin: true,
padding: true,
textShadow: true,
fontFamily: true,
fontSize: true,
fontStyle: true,
fontWeight: true,
opacity: true,
outline: true
},
safeRequire: {
action: true,
amscd: true,
amsmath: true,
amssymbols: true,
autobold: false,
"autoload-all": false,
bbox: true,
begingroup: true,
boldsymbol: true,
cancel: true,
color: true,
enclose: true,
extpfeil: true,
HTML: true,
mathchoice: true,
mhchem: true,
newcommand: true,
noErrors: false,
noUndefined: false,
unicode: true,
verb: true
}
});
var ALLOW = CONFIG.allow;
if (ALLOW.fontsize !== "all") {CONFIG.safeStyles.fontSize = false}
var SAFE = MathJax.Extension.Safe = {
version: VERSION,
config: CONFIG,
div1: document.createElement("div"), // for CSS processing
div2: document.createElement("div"),
//
// Methods called for MathML attribute processing
//
filter: {
href: "filterURL",
src: "filterURL",
altimg: "filterURL",
"class": "filterClass",
style: "filterStyles",
id: "filterID",
fontsize: "filterFontSize",
mathsize: "filterFontSize",
scriptminsize: "filterFontSize",
scriptsizemultiplier: "filterSizeMultiplier",
scriptlevel: "filterScriptLevel"
},
//
// Filter HREF URL's
//
filterURL: function (url) {
var protocol = (url.match(/^\s*([a-z]+):/i)||[null,""])[1].toLowerCase();
if (ALLOW.URLs === "none" ||
(ALLOW.URLs !== "all" && !CONFIG.safeProtocols[protocol])) {url = null}
return url;
},
//
// Filter class names and css ID's
//
filterClass: function (CLASS) {
if (ALLOW.classes === "none" ||
(ALLOW.classes !== "all" && !CLASS.match(/^MJX-[-a-zA-Z0-9_.]+$/))) {CLASS = null}
return CLASS;
},
filterID: function (id) {
if (ALLOW.cssIDs === "none" ||
(ALLOW.cssIDs !== "all" && !id.match(/^MJX-[-a-zA-Z0-9_.]+$/))) {id = null}
return id;
},
//
// Filter style strings
//
filterStyles: function (styles) {
if (ALLOW.styles === "all") {return styles}
if (ALLOW.styles === "none") {return null}
try {
//
// Set the div1 styles to the given styles, and clear div2
//
var STYLE1 = this.div1.style, STYLE2 = this.div2.style;
STYLE1.cssText = styles; STYLE2.cssText = "";
//
// Check each allowed style and transfer OK ones to div2
//
for (var name in CONFIG.safeStyles) {if (CONFIG.safeStyles.hasOwnProperty(name)) {
var value = this.filterStyle(name,STYLE1[name]);
if (value != null) {STYLE2[name] = value}
}}
//
// Return the div2 style string
//
styles = STYLE2.cssText;
} catch (e) {styles = null}
return styles;
},
//
// Filter an individual name:value style pair
//
filterStyle: function (name,value) {
if (typeof value !== "string") {return null}
if (value.match(/^\s*expression/)) {return null}
if (value.match(/javascript:/)) {return null}
return (CONFIG.safeStyles[name] ? value : null);
},
//
// Filter TeX font size values (in em's)
//
filterSize: function (size) {
if (ALLOW.fontsize === "none") {return null}
if (ALLOW.fontsize !== "all")
{size = Math.min(Math.max(size,CONFIG.sizeMin),CONFIG.sizeMax)}
return size;
},
filterFontSize: function (size) {
return (ALLOW.fontsize === "all" ? size: null);
},
//
// Filter scriptsizemultiplier
//
filterSizeMultiplier: function (size) {
if (ALLOW.fontsize === "none") {size = null}
else if (ALLOW.fontsize !== "all") {size = Math.min(1,Math.max(.6,size)).toString()}
return size;
},
//
// Filter scriptLevel
//
filterScriptLevel: function (level) {
if (ALLOW.fontsize === "none") {level = null}
else if (ALLOW.fontsize !== "all") {level = Math.max(0,level).toString()}
return level;
},
//
// Filter TeX extension names
//
filterRequire: function (name) {
if (ALLOW.require === "none" ||
(ALLOW.require !== "all" && !CONFIG.safeRequire[name.toLowerCase()]))
{name = null}
return name;
}
};
HUB.Register.StartupHook("TeX HTML Ready",function () {
var TEX = MathJax.InputJax.TeX;
TEX.Parse.Augment({
//
// Implements \href{url}{math} with URL filter
//
HREF_attribute: function (name) {
var url = SAFE.filterURL(this.GetArgument(name)),
arg = this.GetArgumentMML(name);
if (url) {arg.With({href:url})}
this.Push(arg);
},
//
// Implements \class{name}{math} with class-name filter
//
CLASS_attribute: function (name) {
var CLASS = SAFE.filterClass(this.GetArgument(name)),
arg = this.GetArgumentMML(name);
if (CLASS) {
if (arg["class"] != null) {CLASS = arg["class"] + " " + CLASS}
arg.With({"class":CLASS});
}
this.Push(arg);
},
//
// Implements \style{style-string}{math} with style filter
//
STYLE_attribute: function (name) {
var style = SAFE.filterStyles(this.GetArgument(name)),
arg = this.GetArgumentMML(name);
if (style) {
if (arg.style != null) {
if (style.charAt(style.length-1) !== ";") {style += ";"}
style = arg.style + " " + style;
}
arg.With({style: style});
}
this.Push(arg);
},
//
// Implements \cssId{id}{math} with ID filter
//
ID_attribute: function (name) {
var ID = SAFE.filterID(this.GetArgument(name)),
arg = this.GetArgumentMML(name);
if (ID) {arg.With({id:ID})}
this.Push(arg);
}
});
});
HUB.Register.StartupHook("TeX Jax Ready",function () {
var TEX = MathJax.InputJax.TeX,
PARSE = TEX.Parse, METHOD = SAFE.filter;
PARSE.Augment({
//
// Implements \require{name} with filtering
//
Require: function (name) {
var file = this.GetArgument(name).replace(/.*\//,"").replace(/[^a-z0-9_.-]/ig,"");
file = SAFE.filterRequire(file);
if (file) {this.Extension(null,file)}
},
//
// Controls \mmlToken attributes
//
MmlFilterAttribute: function (name,value) {
if (METHOD[name]) {value = SAFE[METHOD[name]](value)}
return value;
},
//
// Handles font size macros with filtering
//
SetSize: function (name,size) {
size = SAFE.filterSize(size);
if (size) {
this.stack.env.size = size;
this.Push(TEX.Stack.Item.style().With({styles: {mathsize: size+"em"}}));
}
}
});
});
HUB.Register.StartupHook("TeX bbox Ready",function () {
var TEX = MathJax.InputJax.TeX;
//
// Filter the styles for \bbox
//
TEX.Parse.Augment({
BBoxStyle: function (styles) {return SAFE.filterStyles(styles)}
});
});
HUB.Register.StartupHook("MathML Jax Ready",function () {
var PARSE = MathJax.InputJax.MathML.Parse,
METHOD = SAFE.filter;
//
// Filter MathML attributes
//
PARSE.Augment({
filterAttribute: function (name,value) {
if (METHOD[name]) {value = SAFE[METHOD[name]](value)}
return value;
}
});
});
// MathML input (href, style, fontsize, class, id)
HUB.Startup.signal.Post("Safe Extension Ready");
AJAX.loadComplete("[MathJax]/extensions/Safe.js");
})(MathJax.Hub,MathJax.Ajax);