katex 0.16.19 → 0.16.21

package/dist/katex.mjs

@@ -3942,10 +3942,20 @@ var toNode = function toNode(tagName) {
   return node;
 };
 /**
- * Convert into an HTML markup string
+ * https://w3c.github.io/html-reference/syntax.html#syntax-attributes
+ *
+ * > Attribute Names must consist of one or more characters
+ * other than the space characters, U+0000 NULL,
+ * '"', "'", ">", "/", "=", the control characters,
+ * and any characters that are not defined by Unicode.
  */
 
 
+var invalidAttributeNameRegex = /[\s"'>/=\x00-\x1f]/;
+/**
+ * Convert into an HTML markup string
+ */
+
 var toMarkup = function toMarkup(tagName) {
   var markup = "<" + tagName; // Add the class
 
@@ -3968,6 +3978,10 @@ var toMarkup = function toMarkup(tagName) {
 
   for (var attr in this.attributes) {
     if (this.attributes.hasOwnProperty(attr)) {
+      if (invalidAttributeNameRegex.test(attr)) {
+        throw new ParseError("Invalid attribute name '" + attr + "'");
+      }
+
       markup += " " + attr + "=\"" + utils.escape(this.attributes[attr]) + "\"";
     }
   }
@@ -15375,7 +15389,7 @@ defineMacro("\\char", function (context) {
 // \renewcommand{\macro}[args]{definition}
 // TODO: Optional arguments: \newcommand{\macro}[args][default]{definition}
 
-var newcommand = (context, existsOK, nonexistsOK) => {
+var newcommand = (context, existsOK, nonexistsOK, skipIfExists) => {
   var arg = context.consumeArg().tokens;
 
   if (arg.length !== 1) {
@@ -15412,19 +15426,22 @@ var newcommand = (context, existsOK, nonexistsOK) => {
 
     numArgs = parseInt(argText);
     arg = context.consumeArg().tokens;
-  } // Final arg is the expansion of the macro
+  }
 
+  if (!(exists && skipIfExists)) {
+    // Final arg is the expansion of the macro
+    context.macros.set(name, {
+      tokens: arg,
+      numArgs
+    });
+  }
 
-  context.macros.set(name, {
-    tokens: arg,
-    numArgs
-  });
   return '';
 };
 
-defineMacro("\\newcommand", context => newcommand(context, false, true));
-defineMacro("\\renewcommand", context => newcommand(context, true, false));
-defineMacro("\\providecommand", context => newcommand(context, true, true)); // terminal (console) tools
+defineMacro("\\newcommand", context => newcommand(context, false, true, false));
+defineMacro("\\renewcommand", context => newcommand(context, true, false, false));
+defineMacro("\\providecommand", context => newcommand(context, true, true, true)); // terminal (console) tools
 
 defineMacro("\\message", context => {
   var arg = context.consumeArgs(1)[0]; // eslint-disable-next-line no-console
@@ -18413,7 +18430,7 @@ var renderToHTMLTree = function renderToHTMLTree(expression, options) {
   }
 };
 
-var version = "0.16.19";
+var version = "0.16.21";
 var __domTree = {
   Span,
   Anchor,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "katex",
-  "version": "0.16.19",
+  "version": "0.16.21",
   "description": "Fast math typesetting for the web.",
   "main": "dist/katex.js",
   "exports": {

package/src/domTree.js

@@ -17,6 +17,7 @@ import {path} from "./svgGeometry";
 import type Options from "./Options";
 import {DocumentFragment} from "./tree";
 import {makeEm} from "./units";
+import ParseError from "./ParseError";
 
 import type {VirtualNode} from "./tree";
 
@@ -83,6 +84,16 @@ const toNode = function(tagName: string): HTMLElement {
     return node;
 };
 
+/**
+ * https://w3c.github.io/html-reference/syntax.html#syntax-attributes
+ *
+ * > Attribute Names must consist of one or more characters
+ * other than the space characters, U+0000 NULL,
+ * '"', "'", ">", "/", "=", the control characters,
+ * and any characters that are not defined by Unicode.
+ */
+const invalidAttributeNameRegex = /[\s"'>/=\x00-\x1f]/;
+
 /**
  * Convert into an HTML markup string
  */
@@ -110,6 +121,9 @@ const toMarkup = function(tagName: string): string {
     // Add the attributes
     for (const attr in this.attributes) {
         if (this.attributes.hasOwnProperty(attr)) {
+            if (invalidAttributeNameRegex.test(attr)) {
+                throw new ParseError(`Invalid attribute name '${attr}'`);
+            }
             markup += ` ${attr}="${utils.escape(this.attributes[attr])}"`;
         }
     }

package/src/macros.js

@@ -146,7 +146,9 @@ defineMacro("\\char", function(context) {
 // \newcommand{\macro}[args]{definition}
 // \renewcommand{\macro}[args]{definition}
 // TODO: Optional arguments: \newcommand{\macro}[args][default]{definition}
-const newcommand = (context, existsOK: boolean, nonexistsOK: boolean) => {
+const newcommand = (
+    context, existsOK: boolean, nonexistsOK: boolean, skipIfExists: boolean
+) => {
     let arg = context.consumeArg().tokens;
     if (arg.length !== 1) {
         throw new ParseError(
@@ -181,16 +183,21 @@ const newcommand = (context, existsOK: boolean, nonexistsOK: boolean) => {
         arg = context.consumeArg().tokens;
     }
 
-    // Final arg is the expansion of the macro
-    context.macros.set(name, {
-        tokens: arg,
-        numArgs,
-    });
+    if (!(exists && skipIfExists)) {
+        // Final arg is the expansion of the macro
+        context.macros.set(name, {
+            tokens: arg,
+            numArgs,
+        });
+    }
     return '';
 };
-defineMacro("\\newcommand", (context) => newcommand(context, false, true));
-defineMacro("\\renewcommand", (context) => newcommand(context, true, false));
-defineMacro("\\providecommand", (context) => newcommand(context, true, true));
+defineMacro("\\newcommand",
+    (context) => newcommand(context, false, true, false));
+defineMacro("\\renewcommand",
+    (context) => newcommand(context, true, false, false));
+defineMacro("\\providecommand",
+    (context) => newcommand(context, true, true, true));
 
 // terminal (console) tools
 defineMacro("\\message", (context) => {