katex 0.16.20 → 0.16.21

package/dist/katex.mjs

@@ -3942,10 +3942,20 @@ var toNode = function toNode(tagName) {
   return node;
 };
 /**
- * Convert into an HTML markup string
+ * https://w3c.github.io/html-reference/syntax.html#syntax-attributes
+ *
+ * > Attribute Names must consist of one or more characters
+ * other than the space characters, U+0000 NULL,
+ * '"', "'", ">", "/", "=", the control characters,
+ * and any characters that are not defined by Unicode.
  */
 
 
+var invalidAttributeNameRegex = /[\s"'>/=\x00-\x1f]/;
+/**
+ * Convert into an HTML markup string
+ */
+
 var toMarkup = function toMarkup(tagName) {
   var markup = "<" + tagName; // Add the class
 
@@ -3968,6 +3978,10 @@ var toMarkup = function toMarkup(tagName) {
 
   for (var attr in this.attributes) {
     if (this.attributes.hasOwnProperty(attr)) {
+      if (invalidAttributeNameRegex.test(attr)) {
+        throw new ParseError("Invalid attribute name '" + attr + "'");
+      }
+
       markup += " " + attr + "=\"" + utils.escape(this.attributes[attr]) + "\"";
     }
   }
@@ -18416,7 +18430,7 @@ var renderToHTMLTree = function renderToHTMLTree(expression, options) {
   }
 };
 
-var version = "0.16.20";
+var version = "0.16.21";
 var __domTree = {
   Span,
   Anchor,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "katex",
-  "version": "0.16.20",
+  "version": "0.16.21",
   "description": "Fast math typesetting for the web.",
   "main": "dist/katex.js",
   "exports": {

package/src/domTree.js

@@ -17,6 +17,7 @@ import {path} from "./svgGeometry";
 import type Options from "./Options";
 import {DocumentFragment} from "./tree";
 import {makeEm} from "./units";
+import ParseError from "./ParseError";
 
 import type {VirtualNode} from "./tree";
 
@@ -83,6 +84,16 @@ const toNode = function(tagName: string): HTMLElement {
     return node;
 };
 
+/**
+ * https://w3c.github.io/html-reference/syntax.html#syntax-attributes
+ *
+ * > Attribute Names must consist of one or more characters
+ * other than the space characters, U+0000 NULL,
+ * '"', "'", ">", "/", "=", the control characters,
+ * and any characters that are not defined by Unicode.
+ */
+const invalidAttributeNameRegex = /[\s"'>/=\x00-\x1f]/;
+
 /**
  * Convert into an HTML markup string
  */
@@ -110,6 +121,9 @@ const toMarkup = function(tagName: string): string {
     // Add the attributes
     for (const attr in this.attributes) {
         if (this.attributes.hasOwnProperty(attr)) {
+            if (invalidAttributeNameRegex.test(attr)) {
+                throw new ParseError(`Invalid attribute name '${attr}'`);
+            }
             markup += ` ${attr}="${utils.escape(this.attributes[attr])}"`;
         }
     }