@danielsimonjr/mathts-plot 0.3.48 → 0.4.0

package/dist/index.js

@@ -1117,7 +1117,7 @@ function curve3d(x, y, z, opts = {}) {
 }
 
 // src/index.ts
-var VERSION = "0.3.48";
+var VERSION = "0.4.0";
 export {
   VERSION,
   area,

package/dist/render-file.d.ts

@@ -9,9 +9,6 @@ interface RenderOptions {
     timeoutMs?: number;
     density?: number;
     background?: string;
-    /** Enable LaTeX \write18 shell-escape. UNSAFE for untrusted TeX — allows
-     *  arbitrary command execution during compile. Default false. */
-    shellEscape?: boolean;
 }
 interface RunResult {
     code: number | null;
@@ -30,10 +27,9 @@ declare function hasTool(name: string): Promise<boolean>;
  *  the SVG through; `.png`/`.pdf` convert via rsvg-convert (preferred) or resvg.
  *  Rejects with PlotRenderError naming the tool to install if none is present. */
 declare function renderToFile(svg: string, outPath: string, opts?: RenderOptions): Promise<void>;
-/** Build the CLI args for a LaTeX engine. Shell-escape (\write18) is OFF unless
- *  `shellEscape` is true — enabling it is UNSAFE for untrusted TeX (arbitrary
- *  command execution during compile). */
-declare function latexArgs(engine: string, workDir: string, texPath: string, shellEscape: boolean): string[];
+/** Build the CLI args for a LaTeX engine. Shell-escape (\write18) is OFF
+ *  for security (arbitrary command execution during compile). */
+declare function latexArgs(engine: string, workDir: string, texPath: string): string[];
 /** Standalone LaTeX/TikZ source → PDF via pdflatex (preferred) or tectonic.
  *  Compiles in an OS temp dir and copies the resulting PDF to `outPath`.
  *  Rejects with PlotRenderError naming the engine to install if none is found. */

package/dist/render-file.js

@@ -1,7 +1,7 @@
 // src/render-file.ts
 import { spawn } from "child_process";
 import { writeFile, rm, rename, mkdtemp, readFile } from "fs/promises";
-import { extname, join as joinPath } from "path";
+import { extname, join as joinPath, basename } from "path";
 import { tmpdir } from "os";
 var PlotRenderError = class extends Error {
   constructor(message, missingTool) {
@@ -11,8 +11,13 @@ var PlotRenderError = class extends Error {
   }
   missingTool;
 };
+var ALLOWED_TOOLS = ["rsvg-convert", "resvg", "pdflatex", "xelatex", "lualatex", "tectonic"];
 function runTool(cmd, args, opts = {}) {
   return new Promise((resolve, reject) => {
+    if (!ALLOWED_TOOLS.includes(basename(cmd))) {
+      reject(new PlotRenderError(`Security Error: Execution of tool '${cmd}' is not allowed.`));
+      return;
+    }
     const child = spawn(cmd, args, { timeout: opts.timeoutMs ?? 3e4 });
     const out = [];
     let err = "";
@@ -39,6 +44,9 @@ async function hasTool(name) {
   }
 }
 async function renderToFile(svg, outPath, opts = {}) {
+  if (opts.tool && !ALLOWED_TOOLS.includes(basename(opts.tool))) {
+    throw new PlotRenderError(`Security Error: Execution of tool '${opts.tool}' is not allowed.`);
+  }
   const ext = extname(outPath).toLowerCase();
   if (ext === ".svg") {
     await writeFile(outPath, svg, "utf-8");
@@ -94,12 +102,12 @@ async function renderToFile(svg, outPath, opts = {}) {
     "rsvg-convert"
   );
 }
-function latexArgs(engine, workDir, texPath, shellEscape) {
+function latexArgs(engine, workDir, texPath) {
   if (engine === "tectonic") {
-    return [...shellEscape ? ["-Z", "shell-escape"] : [], "--outdir", workDir, texPath];
+    return ["--outdir", workDir, texPath];
   }
   return [
-    shellEscape ? "-shell-escape" : "-no-shell-escape",
+    "-no-shell-escape",
     "-interaction=nonstopmode",
     "-halt-on-error",
     "-output-directory",
@@ -108,6 +116,9 @@ function latexArgs(engine, workDir, texPath, shellEscape) {
   ];
 }
 async function latexToPdf(texSource, outPath, opts = {}) {
+  if (opts.tool && !ALLOWED_TOOLS.includes(basename(opts.tool))) {
+    throw new PlotRenderError(`Security Error: Execution of tool '${opts.tool}' is not allowed.`);
+  }
   if (extname(outPath).toLowerCase() !== ".pdf") {
     throw new PlotRenderError(`latexToPdf output must be a .pdf path (got '${outPath}')`);
   }
@@ -129,7 +140,7 @@ async function latexToPdf(texSource, outPath, opts = {}) {
   try {
     const texPath = joinPath(work, "doc.tex");
     await writeFile(texPath, texSource, "utf-8");
-    const args = latexArgs(engine, work, texPath, opts.shellEscape === true);
+    const args = latexArgs(engine, work, texPath);
     const r = await runTool(engine, args, { timeoutMs: opts.timeoutMs ?? 6e4 });
     const pdfPath = joinPath(work, "doc.pdf");
     let pdf;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@danielsimonjr/mathts-plot",
-  "version": "0.3.48",
+  "version": "0.4.0",
   "description": "Headless SVG 2D/3D plotting for MathTS — dependency-light, expression-aware, built on core/functions/expression",
   "author": "Daniel Simon Jr.",
   "license": "MIT",
@@ -34,9 +34,9 @@
     "clean": "rm -rf dist"
   },
   "dependencies": {
-    "@danielsimonjr/mathts-core": "^0.13.1",
-    "@danielsimonjr/mathts-functions": "^0.61.0",
-    "@danielsimonjr/mathts-expression": "^0.6.7"
+    "@danielsimonjr/mathts-core": "^0.14.0",
+    "@danielsimonjr/mathts-functions": "^0.62.0",
+    "@danielsimonjr/mathts-expression": "^0.7.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.2",
@@ -49,7 +49,7 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/danielsimonjr/mathts",
+    "url": "git+https://github.com/danielsimonjr/MathTS.git",
     "directory": "plot"
   },
   "keywords": [