katex 0.16.9 → 0.16.11

package/src/utils.js

@@ -93,11 +93,30 @@ export const assert = function<T>(value: ?T): T {
 
 /**
  * Return the protocol of a URL, or "_relative" if the URL does not specify a
- * protocol (and thus is relative).
+ * protocol (and thus is relative), or `null` if URL has invalid protocol
+ * (so should be outright rejected).
  */
-export const protocolFromUrl = function(url: string): string {
-    const protocol = /^\s*([^\\/#]*?)(?::|&#0*58|&#x0*3a)/i.exec(url);
-    return (protocol != null ? protocol[1] : "_relative");
+export const protocolFromUrl = function(url: string): string | null {
+    // Check for possible leading protocol.
+    // https://url.spec.whatwg.org/#url-parsing strips leading whitespace
+    // (U+20) or C0 control (U+00-U+1F) characters.
+    // eslint-disable-next-line no-control-regex
+    const protocol = /^[\x00-\x20]*([^\\/#?]*?)(:|&#0*58|&#x0*3a|&colon)/i
+    .exec(url);
+    if (!protocol) {
+        return "_relative";
+    }
+    // Reject weird colons
+    if (protocol[2] !== ":") {
+        return null;
+    }
+    // Reject invalid characters in scheme according to
+    // https://datatracker.ietf.org/doc/html/rfc3986#section-3.1
+    if (!/^[a-zA-Z][a-zA-Z0-9+\-.]*$/.test(protocol[1])) {
+        return null;
+    }
+    // Lowercase the protocol
+    return protocol[1].toLowerCase();
 };
 
 export default {

package/src/fonts.less

@@ -1,64 +0,0 @@
-@font-folder: "../fonts";
-@use-ttf: true;
-@use-woff: true;
-@use-woff2: true;
-
-.use-woff2(@family, @family-suffix) when (@use-woff2 = true) {
-    src+: url('@{font-folder}/KaTeX_@{family}-@{family-suffix}.woff2') format('woff2')
-}
-
-.use-woff(@family, @family-suffix) when (@use-woff = true) {
-    src+: url('@{font-folder}/KaTeX_@{family}-@{family-suffix}.woff') format('woff')
-}
-
-.use-ttf(@family, @family-suffix) when (@use-ttf = true) {
-    src+: url('@{font-folder}/KaTeX_@{family}-@{family-suffix}.ttf') format('truetype')
-}
-
-.generate-suffix(@weight, @style) when (@weight = normal) and (@style = normal) {
-    @suffix: 'Regular';
-}
-.generate-suffix(@weight, @style) when (@weight = normal) and (@style = italic) {
-    @suffix: 'Italic';
-}
-.generate-suffix(@weight, @style) when (@weight = bold) and (@style = normal) {
-    @suffix: 'Bold';
-}
-.generate-suffix(@weight, @style) when (@weight = bold) and (@style = italic) {
-    @suffix: 'BoldItalic';
-}
-
-.font-face(@family, @weight, @style) {
-    .generate-suffix(@weight, @style);
-    @font-face {
-        font-family: 'KaTeX_@{family}';
-        .use-woff2(@family, @suffix);
-        .use-woff(@family, @suffix);
-        .use-ttf(@family, @suffix);
-        font-weight: @weight;
-        font-style: @style;
-    }
-}
-
-.font-face('AMS', normal, normal);
-.font-face('Caligraphic', bold, normal);
-.font-face('Caligraphic', normal, normal);
-.font-face('Fraktur', bold, normal);
-.font-face('Fraktur', normal, normal);
-.font-face('Main', bold, normal);
-.font-face('Main', bold, italic);
-.font-face('Main', normal, italic);
-.font-face('Main', normal, normal);
-//.font-face('Math', bold, normal);
-.font-face('Math', bold, italic);
-.font-face('Math', normal, italic);
-//.font-face('Math', normal, normal);
-.font-face('SansSerif', bold, normal);
-.font-face('SansSerif', normal, italic);
-.font-face('SansSerif', normal, normal);
-.font-face('Script', normal, normal);
-.font-face('Size1', normal, normal);
-.font-face('Size2', normal, normal);
-.font-face('Size3', normal, normal);
-.font-face('Size4', normal, normal);
-.font-face('Typewriter', normal, normal);