temml 0.10.22 → 0.10.24

package/dist/temml.mjs

@@ -144,11 +144,29 @@ const assert = function(value) {
 
 /**
  * Return the protocol of a URL, or "_relative" if the URL does not specify a
- * protocol (and thus is relative).
+ * protocol (and thus is relative), or `null` if URL has invalid protocol
+ * (so should be outright rejected).
  */
 const protocolFromUrl = function(url) {
-  const protocol = /^\s*([^\\/#]*?)(?::|&#0*58|&#x0*3a)/i.exec(url);
-  return protocol != null ? protocol[1] : "_relative";
+  // Check for possible leading protocol.
+  // https://url.spec.whatwg.org/#url-parsing strips leading whitespace
+  // (\x00) or C0 control (\x00-\x1F) characters.
+  // eslint-disable-next-line no-control-regex
+  const protocol = /^[\x00-\x20]*([^\\/#?]*?)(:|&#0*58|&#x0*3a|&colon)/i.exec(url);
+  if (!protocol) {
+    return "_relative";
+  }
+  // Reject weird colons
+  if (protocol[2] !== ":") {
+    return null;
+  }
+  // Reject invalid characters in scheme according to
+  // https://datatracker.ietf.org/doc/html/rfc3986#section-3.1
+  if (!/^[a-zA-Z][a-zA-Z0-9+\-.]*$/.test(protocol[1])) {
+    return null;
+  }
+  // Lowercase the protocol
+  return protocol[1].toLowerCase();
 };
 
 /**
@@ -213,7 +231,11 @@ class Settings {
    */
   isTrusted(context) {
     if (context.url && !context.protocol) {
-      context.protocol = utils.protocolFromUrl(context.url);
+      const protocol = utils.protocolFromUrl(context.url);
+      if (protocol == null) {
+        return false
+      }
+      context.protocol = protocol;
     }
     const trust = typeof this.trust === "function" ? this.trust(context) : this.trust;
     return Boolean(trust);
@@ -1024,6 +1046,7 @@ defineSymbol(math, mathord, "\u2609", "\\astrosun", true);
 defineSymbol(math, mathord, "\u263c", "\\sun", true);
 defineSymbol(math, mathord, "\u263e", "\\leftmoon", true);
 defineSymbol(math, mathord, "\u263d", "\\rightmoon", true);
+defineSymbol(math, mathord, "\u2295", "\\Earth");
 
 // AMS Negated Binary Relations
 defineSymbol(math, rel, "\u226e", "\\nless", true);
@@ -1251,6 +1274,73 @@ defineSymbol(math, bin, "\u27d5", "\\leftouterjoin", true);
 defineSymbol(math, bin, "\u27d6", "\\rightouterjoin", true);
 defineSymbol(math, bin, "\u27d7", "\\fullouterjoin", true);
 
+// stix Binary Operators
+defineSymbol(math, bin, "\u2238", "\\dotminus", true);
+defineSymbol(math, bin, "\u27D1", "\\wedgedot", true);
+defineSymbol(math, bin, "\u27C7", "\\veedot", true);
+defineSymbol(math, bin, "\u2A62", "\\doublebarvee", true);
+defineSymbol(math, bin, "\u2A63", "\\veedoublebar", true);
+defineSymbol(math, bin, "\u2A5F", "\\wedgebar", true);
+defineSymbol(math, bin, "\u2A60", "\\wedgedoublebar", true);
+defineSymbol(math, bin, "\u2A54", "\\Vee", true);
+defineSymbol(math, bin, "\u2A53", "\\Wedge", true);
+defineSymbol(math, bin, "\u2A43", "\\barcap", true);
+defineSymbol(math, bin, "\u2A42", "\\barcup", true);
+defineSymbol(math, bin, "\u2A48", "\\capbarcup", true);
+defineSymbol(math, bin, "\u2A40", "\\capdot", true);
+defineSymbol(math, bin, "\u2A47", "\\capovercup", true);
+defineSymbol(math, bin, "\u2A46", "\\cupovercap", true);
+defineSymbol(math, bin, "\u2A4D", "\\closedvarcap", true);
+defineSymbol(math, bin, "\u2A4C", "\\closedvarcup", true);
+defineSymbol(math, bin, "\u2A2A", "\\minusdot", true);
+defineSymbol(math, bin, "\u2A2B", "\\minusfdots", true);
+defineSymbol(math, bin, "\u2A2C", "\\minusrdots", true);
+defineSymbol(math, bin, "\u22BB", "\\Xor", true);
+defineSymbol(math, bin, "\u22BC", "\\Nand", true);
+defineSymbol(math, bin, "\u22BD", "\\Nor", true);
+defineSymbol(math, bin, "\u22BD", "\\barvee");
+defineSymbol(math, bin, "\u2AF4", "\\interleave", true);
+defineSymbol(math, bin, "\u29E2", "\\shuffle", true);
+defineSymbol(math, bin, "\u2AF6", "\\threedotcolon", true);
+defineSymbol(math, bin, "\u2982", "\\typecolon", true);
+defineSymbol(math, bin, "\u223E", "\\invlazys", true);
+defineSymbol(math, bin, "\u2A4B", "\\twocaps", true);
+defineSymbol(math, bin, "\u2A4A", "\\twocups", true);
+defineSymbol(math, bin, "\u2A4E", "\\Sqcap", true);
+defineSymbol(math, bin, "\u2A4F", "\\Sqcup", true);
+defineSymbol(math, bin, "\u2A56", "\\veeonvee", true);
+defineSymbol(math, bin, "\u2A55", "\\wedgeonwedge", true);
+defineSymbol(math, bin, "\u29D7", "\\blackhourglass", true);
+defineSymbol(math, bin, "\u29C6", "\\boxast", true);
+defineSymbol(math, bin, "\u29C8", "\\boxbox", true);
+defineSymbol(math, bin, "\u29C7", "\\boxcircle", true);
+defineSymbol(math, bin, "\u229C", "\\circledequal", true);
+defineSymbol(math, bin, "\u29B7", "\\circledparallel", true);
+defineSymbol(math, bin, "\u29B6", "\\circledvert", true);
+defineSymbol(math, bin, "\u29B5", "\\circlehbar", true);
+defineSymbol(math, bin, "\u27E1", "\\concavediamond", true);
+defineSymbol(math, bin, "\u27E2", "\\concavediamondtickleft", true);
+defineSymbol(math, bin, "\u27E3", "\\concavediamondtickright", true);
+defineSymbol(math, bin, "\u22C4", "\\diamond", true);
+defineSymbol(math, bin, "\u29D6", "\\hourglass", true);
+defineSymbol(math, bin, "\u27E0", "\\lozengeminus", true);
+defineSymbol(math, bin, "\u233D", "\\obar", true);
+defineSymbol(math, bin, "\u29B8", "\\obslash", true);
+defineSymbol(math, bin, "\u2A38", "\\odiv", true);
+defineSymbol(math, bin, "\u29C1", "\\ogreaterthan", true);
+defineSymbol(math, bin, "\u29C0", "\\olessthan", true);
+defineSymbol(math, bin, "\u29B9", "\\operp", true);
+defineSymbol(math, bin, "\u2A37", "\\Otimes", true);
+defineSymbol(math, bin, "\u2A36", "\\otimeshat", true);
+defineSymbol(math, bin, "\u22C6", "\\star", true);
+defineSymbol(math, bin, "\u25B3", "\\triangle", true);
+defineSymbol(math, bin, "\u2A3A", "\\triangleminus", true);
+defineSymbol(math, bin, "\u2A39", "\\triangleplus", true);
+defineSymbol(math, bin, "\u2A3B", "\\triangletimes", true);
+defineSymbol(math, bin, "\u27E4", "\\whitesquaretickleft", true);
+defineSymbol(math, bin, "\u27E5", "\\whitesquaretickright", true);
+defineSymbol(math, bin, "\u2A33", "\\smashtimes", true);
+
 // AMS Arrows
 // Note: unicode-math maps \u21e2 to their own function \rightdasharrow.
 // We'll map it to AMS function \dashrightarrow. It produces the same atom.
@@ -1491,8 +1581,8 @@ defineSymbol(math, spacing, null, "\\allowbreak");
 defineSymbol(math, punct, ",", ",");
 defineSymbol(text, punct, ":", ":");
 defineSymbol(math, punct, ";", ";");
-defineSymbol(math, bin, "\u22bc", "\\barwedge", true);
-defineSymbol(math, bin, "\u22bb", "\\veebar", true);
+defineSymbol(math, bin, "\u22bc", "\\barwedge");
+defineSymbol(math, bin, "\u22bb", "\\veebar");
 defineSymbol(math, bin, "\u2299", "\\odot", true);
 // Firefox turns ⊕ into an emoji. So append \uFE0E. Define Unicode character in macros, not here.
 defineSymbol(math, bin, "\u2295\uFE0E", "\\oplus");
@@ -1505,7 +1595,6 @@ defineSymbol(math, bin, "\u25b3", "\\bigtriangleup");
 defineSymbol(math, bin, "\u25bd", "\\bigtriangledown");
 defineSymbol(math, bin, "\u2020", "\\dagger");
 defineSymbol(math, bin, "\u22c4", "\\diamond");
-defineSymbol(math, bin, "\u22c6", "\\star");
 defineSymbol(math, bin, "\u25c3", "\\triangleleft");
 defineSymbol(math, bin, "\u25b9", "\\triangleright");
 defineSymbol(math, open, "{", "\\{");
@@ -2019,9 +2108,11 @@ const consolidateText = mrow => {
 };
 
 const numberRegEx$1 = /^[0-9]$/;
-const isCommaOrDot = node => {
-  return (node.type === "atom" && node.text === ",") ||
-         (node.type === "textord" && node.text === ".")
+const isDotOrComma = (node, followingNode) => {
+  return ((node.type === "textord" && node.text === ".") ||
+    (node.type === "atom" && node.text === ",")) &&
+    // Don't consolidate if there is a space after the comma.
+    node.loc && followingNode.loc && node.loc.end === followingNode.loc.start
 };
 const consolidateNumbers = expression => {
   // Consolidate adjacent numbers. We want to return <mn>1,506.3</mn>,
@@ -2044,7 +2135,8 @@ const consolidateNumbers = expression => {
 
   // Determine if numeral groups are separated by a comma or dot.
   for (let i = nums.length - 1; i > 0; i--) {
-    if (nums[i - 1].end === nums[i].start - 2 && isCommaOrDot(expression[nums[i].start - 1])) {
+    if (nums[i - 1].end === nums[i].start - 2 &&
+      isDotOrComma(expression[nums[i].start - 1], expression[nums[i].start])) {
       // Merge the two groups.
       nums[i - 1].end = nums[i].end;
       nums.splice(i, 1);
@@ -3477,6 +3569,9 @@ defineFunction({
 
     if (funcName === "\\edef" || funcName === "\\xdef") {
       tokens = parser.gullet.expandTokens(tokens);
+      if (tokens.length > parser.gullet.settings.maxExpand) {
+        throw new ParseError("Too many expansions in an " + funcName);
+      }
       tokens.reverse(); // to fit in with stack order
     }
     // Final arg is the expansion of the macro
@@ -5110,6 +5205,21 @@ defineFunction({
   }
 });
 
+const isLongVariableName = (group, font) => {
+  if (font !== "mathrm" || group.body.type !== "ordgroup" || group.body.body.length === 1) {
+    return false
+  }
+  if (group.body.body[0].type !== "mathord") { return false }
+  for (let i = 1; i < group.body.body.length; i++) {
+    const parseNodeType = group.body.body[i].type;
+    if (!(parseNodeType ===  "mathord" ||
+    (parseNodeType ===  "textord" && !isNaN(group.body.body[i].text)))) {
+      return false
+    }
+  }
+  return true
+};
+
 const mathmlBuilder$6 = (group, style) => {
   const font = group.font;
   const newStyle = style.withFont(font);
@@ -5121,6 +5231,20 @@ const mathmlBuilder$6 = (group, style) => {
     return mathGroup
   }
   // Check if it is possible to consolidate elements into a single <mi> element.
+  if (isLongVariableName(group, font)) {
+    // This is a \mathrm{…} group. It gets special treatment because symbolsOrd.js
+    // wraps <mi> elements with <mrow>s to work around a Firefox bug.
+    const mi = mathGroup.children[0].children[0];
+    delete mi.attributes.mathvariant;
+    for (let i = 1; i < mathGroup.children.length; i++) {
+      mi.children[0].text += mathGroup.children[i].type === "mn"
+        ? mathGroup.children[i].children[0].text
+        : mathGroup.children[i].children[0].children[0].text;
+    }
+    // Wrap in a <mrow> to prevent the same Firefox bug.
+    const bogus = new mathMLTree.MathNode("mtext", new mathMLTree.TextNode("\u200b"));
+    return new mathMLTree.MathNode("mrow", [bogus, mi])
+  }
   let canConsolidate = mathGroup.children[0].type === "mo";
   for (let i = 1; i < mathGroup.children.length; i++) {
     if (mathGroup.children[i].type === "mo" && font === "boldsymbol") {
@@ -13186,7 +13310,7 @@ class Style {
  * https://mit-license.org/
  */
 
-const version = "0.10.22";
+const version = "0.10.24";
 
 function postProcess(block) {
   const labelMap = {};

package/dist/temmlPostProcess.js

@@ -14,7 +14,7 @@
    * https://mit-license.org/
    */
 
-  const version = "0.10.22";
+  const version = "0.10.24";
 
   function postProcess(block) {
     const labelMap = {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "temml",
-  "version": "0.10.22",
+  "version": "0.10.24",
   "description": "TeX to MathML conversion in JavaScript.",
   "main": "dist/temml.js",
   "engines": {

package/src/Settings.js

@@ -42,7 +42,11 @@ export default class Settings {
    */
   isTrusted(context) {
     if (context.url && !context.protocol) {
-      context.protocol = utils.protocolFromUrl(context.url);
+      const protocol = utils.protocolFromUrl(context.url);
+      if (protocol == null) {
+        return false
+      }
+      context.protocol = protocol
     }
     const trust = typeof this.trust === "function" ? this.trust(context) : this.trust;
     return Boolean(trust);

package/src/buildMathML.js

@@ -80,9 +80,11 @@ export const consolidateText = mrow => {
 }
 
 const numberRegEx = /^[0-9]$/
-const isCommaOrDot = node => {
-  return (node.type === "atom" && node.text === ",") ||
-         (node.type === "textord" && node.text === ".")
+const isDotOrComma = (node, followingNode) => {
+  return ((node.type === "textord" && node.text === ".") ||
+    (node.type === "atom" && node.text === ",")) &&
+    // Don't consolidate if there is a space after the comma.
+    node.loc && followingNode.loc && node.loc.end === followingNode.loc.start
 }
 const consolidateNumbers = expression => {
   // Consolidate adjacent numbers. We want to return <mn>1,506.3</mn>,
@@ -105,7 +107,8 @@ const consolidateNumbers = expression => {
 
   // Determine if numeral groups are separated by a comma or dot.
   for (let i = nums.length - 1; i > 0; i--) {
-    if (nums[i - 1].end === nums[i].start - 2 && isCommaOrDot(expression[nums[i].start - 1])) {
+    if (nums[i - 1].end === nums[i].start - 2 &&
+      isDotOrComma(expression[nums[i].start - 1], expression[nums[i].start])) {
       // Merge the two groups.
       nums[i - 1].end = nums[i].end
       nums.splice(i, 1)

package/src/functions/def.js

@@ -141,6 +141,9 @@ defineFunction({
 
     if (funcName === "\\edef" || funcName === "\\xdef") {
       tokens = parser.gullet.expandTokens(tokens);
+      if (tokens.length > parser.gullet.settings.maxExpand) {
+        throw new ParseError("Too many expansions in an " + funcName);
+      }
       tokens.reverse(); // to fit in with stack order
     }
     // Final arg is the expansion of the macro

package/src/functions/font.js

@@ -2,6 +2,21 @@ import defineFunction, { normalizeArgument } from "../defineFunction"
 import * as mml from "../buildMathML"
 import mathMLTree from "../mathMLTree"
 
+const isLongVariableName = (group, font) => {
+  if (font !== "mathrm" || group.body.type !== "ordgroup" || group.body.body.length === 1) {
+    return false
+  }
+  if (group.body.body[0].type !== "mathord") { return false }
+  for (let i = 1; i < group.body.body.length; i++) {
+    const parseNodeType = group.body.body[i].type
+    if (!(parseNodeType ===  "mathord" ||
+    (parseNodeType ===  "textord" && !isNaN(group.body.body[i].text)))) {
+      return false
+    }
+  }
+  return true
+}
+
 const mathmlBuilder = (group, style) => {
   const font = group.font
   const newStyle = style.withFont(font)
@@ -13,6 +28,20 @@ const mathmlBuilder = (group, style) => {
     return mathGroup
   }
   // Check if it is possible to consolidate elements into a single <mi> element.
+  if (isLongVariableName(group, font)) {
+    // This is a \mathrm{…} group. It gets special treatment because symbolsOrd.js
+    // wraps <mi> elements with <mrow>s to work around a Firefox bug.
+    const mi = mathGroup.children[0].children[0];
+    delete mi.attributes.mathvariant
+    for (let i = 1; i < mathGroup.children.length; i++) {
+      mi.children[0].text += mathGroup.children[i].type === "mn"
+        ? mathGroup.children[i].children[0].text
+        : mathGroup.children[i].children[0].children[0].text
+    }
+    // Wrap in a <mrow> to prevent the same Firefox bug.
+    const bogus = new mathMLTree.MathNode("mtext", new mathMLTree.TextNode("\u200b"))
+    return new mathMLTree.MathNode("mrow", [bogus, mi])
+  }
   let canConsolidate = mathGroup.children[0].type === "mo"
   for (let i = 1; i < mathGroup.children.length; i++) {
     if (mathGroup.children[i].type === "mo" && font === "boldsymbol") {
@@ -25,7 +54,7 @@ const mathmlBuilder = (group, style) => {
   }
   if (!canConsolidate) { return mathGroup }
   // Consolidate the <mi> elements.
-  const mi = mathGroup.children[0]
+  const mi = mathGroup.children[0];
   for (let i = 1; i < mathGroup.children.length; i++) {
     mi.children.push(mathGroup.children[i].children[0])
   }

package/src/postProcess.js

@@ -8,7 +8,7 @@
  * https://mit-license.org/
  */
 
-export const version = "0.10.22";
+export const version = "0.10.24";
 
 export function postProcess(block) {
   const labelMap = {}

package/src/symbols.js

@@ -218,6 +218,7 @@ defineSymbol(math, mathord, "\u2609", "\\astrosun", true);
 defineSymbol(math, mathord, "\u263c", "\\sun", true);
 defineSymbol(math, mathord, "\u263e", "\\leftmoon", true);
 defineSymbol(math, mathord, "\u263d", "\\rightmoon", true);
+defineSymbol(math, mathord, "\u2295", "\\Earth");
 
 // AMS Negated Binary Relations
 defineSymbol(math, rel, "\u226e", "\\nless", true);
@@ -445,6 +446,73 @@ defineSymbol(math, bin, "\u27d5", "\\leftouterjoin", true);
 defineSymbol(math, bin, "\u27d6", "\\rightouterjoin", true);
 defineSymbol(math, bin, "\u27d7", "\\fullouterjoin", true);
 
+// stix Binary Operators
+defineSymbol(math, bin, "\u2238", "\\dotminus", true);
+defineSymbol(math, bin, "\u27D1", "\\wedgedot", true);
+defineSymbol(math, bin, "\u27C7", "\\veedot", true);
+defineSymbol(math, bin, "\u2A62", "\\doublebarvee", true);
+defineSymbol(math, bin, "\u2A63", "\\veedoublebar", true)
+defineSymbol(math, bin, "\u2A5F", "\\wedgebar", true)
+defineSymbol(math, bin, "\u2A60", "\\wedgedoublebar", true)
+defineSymbol(math, bin, "\u2A54", "\\Vee", true)
+defineSymbol(math, bin, "\u2A53", "\\Wedge", true)
+defineSymbol(math, bin, "\u2A43", "\\barcap", true)
+defineSymbol(math, bin, "\u2A42", "\\barcup", true)
+defineSymbol(math, bin, "\u2A48", "\\capbarcup", true)
+defineSymbol(math, bin, "\u2A40", "\\capdot", true)
+defineSymbol(math, bin, "\u2A47", "\\capovercup", true)
+defineSymbol(math, bin, "\u2A46", "\\cupovercap", true)
+defineSymbol(math, bin, "\u2A4D", "\\closedvarcap", true)
+defineSymbol(math, bin, "\u2A4C", "\\closedvarcup", true)
+defineSymbol(math, bin, "\u2A2A", "\\minusdot", true)
+defineSymbol(math, bin, "\u2A2B", "\\minusfdots", true)
+defineSymbol(math, bin, "\u2A2C", "\\minusrdots", true)
+defineSymbol(math, bin, "\u22BB", "\\Xor", true)
+defineSymbol(math, bin, "\u22BC", "\\Nand", true)
+defineSymbol(math, bin, "\u22BD", "\\Nor", true)
+defineSymbol(math, bin, "\u22BD", "\\barvee")
+defineSymbol(math, bin, "\u2AF4", "\\interleave", true)
+defineSymbol(math, bin, "\u29E2", "\\shuffle", true)
+defineSymbol(math, bin, "\u2AF6", "\\threedotcolon", true)
+defineSymbol(math, bin, "\u2982", "\\typecolon", true)
+defineSymbol(math, bin, "\u223E", "\\invlazys", true)
+defineSymbol(math, bin, "\u2A4B", "\\twocaps", true)
+defineSymbol(math, bin, "\u2A4A", "\\twocups", true)
+defineSymbol(math, bin, "\u2A4E", "\\Sqcap", true)
+defineSymbol(math, bin, "\u2A4F", "\\Sqcup", true)
+defineSymbol(math, bin, "\u2A56", "\\veeonvee", true)
+defineSymbol(math, bin, "\u2A55", "\\wedgeonwedge", true)
+defineSymbol(math, bin, "\u29D7", "\\blackhourglass", true)
+defineSymbol(math, bin, "\u29C6", "\\boxast", true)
+defineSymbol(math, bin, "\u29C8", "\\boxbox", true)
+defineSymbol(math, bin, "\u29C7", "\\boxcircle", true)
+defineSymbol(math, bin, "\u229C", "\\circledequal", true)
+defineSymbol(math, bin, "\u29B7", "\\circledparallel", true)
+defineSymbol(math, bin, "\u29B6", "\\circledvert", true)
+defineSymbol(math, bin, "\u29B5", "\\circlehbar", true)
+defineSymbol(math, bin, "\u27E1", "\\concavediamond", true)
+defineSymbol(math, bin, "\u27E2", "\\concavediamondtickleft", true)
+defineSymbol(math, bin, "\u27E3", "\\concavediamondtickright", true)
+defineSymbol(math, bin, "\u22C4", "\\diamond", true)
+defineSymbol(math, bin, "\u29D6", "\\hourglass", true)
+defineSymbol(math, bin, "\u27E0", "\\lozengeminus", true)
+defineSymbol(math, bin, "\u233D", "\\obar", true)
+defineSymbol(math, bin, "\u29B8", "\\obslash", true)
+defineSymbol(math, bin, "\u2A38", "\\odiv", true)
+defineSymbol(math, bin, "\u29C1", "\\ogreaterthan", true)
+defineSymbol(math, bin, "\u29C0", "\\olessthan", true)
+defineSymbol(math, bin, "\u29B9", "\\operp", true)
+defineSymbol(math, bin, "\u2A37", "\\Otimes", true)
+defineSymbol(math, bin, "\u2A36", "\\otimeshat", true)
+defineSymbol(math, bin, "\u22C6", "\\star", true)
+defineSymbol(math, bin, "\u25B3", "\\triangle", true)
+defineSymbol(math, bin, "\u2A3A", "\\triangleminus", true)
+defineSymbol(math, bin, "\u2A39", "\\triangleplus", true)
+defineSymbol(math, bin, "\u2A3B", "\\triangletimes", true)
+defineSymbol(math, bin, "\u27E4", "\\whitesquaretickleft", true)
+defineSymbol(math, bin, "\u27E5", "\\whitesquaretickright", true)
+defineSymbol(math, bin, "\u2A33", "\\smashtimes", true)
+
 // AMS Arrows
 // Note: unicode-math maps \u21e2 to their own function \rightdasharrow.
 // We'll map it to AMS function \dashrightarrow. It produces the same atom.
@@ -685,8 +753,8 @@ defineSymbol(math, spacing, null, "\\allowbreak");
 defineSymbol(math, punct, ",", ",");
 defineSymbol(text, punct, ":", ":");
 defineSymbol(math, punct, ";", ";");
-defineSymbol(math, bin, "\u22bc", "\\barwedge", true);
-defineSymbol(math, bin, "\u22bb", "\\veebar", true);
+defineSymbol(math, bin, "\u22bc", "\\barwedge");
+defineSymbol(math, bin, "\u22bb", "\\veebar");
 defineSymbol(math, bin, "\u2299", "\\odot", true);
 // Firefox turns ⊕ into an emoji. So append \uFE0E. Define Unicode character in macros, not here.
 defineSymbol(math, bin, "\u2295\uFE0E", "\\oplus");
@@ -699,7 +767,6 @@ defineSymbol(math, bin, "\u25b3", "\\bigtriangleup");
 defineSymbol(math, bin, "\u25bd", "\\bigtriangledown");
 defineSymbol(math, bin, "\u2020", "\\dagger");
 defineSymbol(math, bin, "\u22c4", "\\diamond");
-defineSymbol(math, bin, "\u22c6", "\\star");
 defineSymbol(math, bin, "\u25c3", "\\triangleleft");
 defineSymbol(math, bin, "\u25b9", "\\triangleright");
 defineSymbol(math, open, "{", "\\{");

package/src/utils.js

@@ -81,11 +81,29 @@ export const assert = function(value) {
 
 /**
  * Return the protocol of a URL, or "_relative" if the URL does not specify a
- * protocol (and thus is relative).
+ * protocol (and thus is relative), or `null` if URL has invalid protocol
+ * (so should be outright rejected).
  */
 export const protocolFromUrl = function(url) {
-  const protocol = /^\s*([^\\/#]*?)(?::|&#0*58|&#x0*3a)/i.exec(url);
-  return protocol != null ? protocol[1] : "_relative";
+  // Check for possible leading protocol.
+  // https://url.spec.whatwg.org/#url-parsing strips leading whitespace
+  // (\x00) or C0 control (\x00-\x1F) characters.
+  // eslint-disable-next-line no-control-regex
+  const protocol = /^[\x00-\x20]*([^\\/#?]*?)(:|&#0*58|&#x0*3a|&colon)/i.exec(url);
+  if (!protocol) {
+    return "_relative";
+  }
+  // Reject weird colons
+  if (protocol[2] !== ":") {
+    return null;
+  }
+  // Reject invalid characters in scheme according to
+  // https://datatracker.ietf.org/doc/html/rfc3986#section-3.1
+  if (!/^[a-zA-Z][a-zA-Z0-9+\-.]*$/.test(protocol[1])) {
+    return null;
+  }
+  // Lowercase the protocol
+  return protocol[1].toLowerCase();
 };
 
 /**