temml 0.13.4 → 0.13.5

package/README.md

@@ -2,7 +2,7 @@
 
 | Library       | Minified JavaScript + CSS |
 |:--------------|:-------------------------:|
-| Temml         |         173 KB            |
+| Temml         |         174 KB            |
 | MathJax 2.7.5 |         338 KB            |
 | KaTeX         |         280 KB            |
 | TeXZilla      |         168 KB            |

package/dist/Temml-Asana.css

@@ -331,7 +331,7 @@ math > mrow {
 
 /* Default mtd top padding is 0.5ex per MathML-Core and user-agent CSS */
 /* We adjust for jot and small */
-mtable.tml-jot mtd {
+mtable.tml-jot > mtr > mtd {
   padding-top: 0.7ex;
   padding-bottom: 0.7ex;
 }
@@ -347,7 +347,7 @@ mtable.tml-small mtd {
   math > mrow { padding: 0 }
   /* Adjust Firefox spacing between array rows */
   mtd, mtable.tml-small mtd { padding-top: 0; padding-bottom: 0; }
-  mtable.tml-jot mtd { padding-top: 0.2ex; padding-bottom: 0.ex; }
+  mtable.tml-jot > mtr > mtd { padding-top: 0.2ex; padding-bottom: 0.2ex; }
 }
 
 /* AMS environment auto-numbering via CSS counter. */

package/dist/Temml-Latin-Modern.css

@@ -349,7 +349,7 @@ math > mrow {
 
 /* Default mtd top padding is 0.5ex per MathML-Core and user-agent CSS */
 /* We adjust for jot and small */
-mtable.tml-jot mtd {
+mtable.tml-jot > mtr > mtd {
   padding-top: 0.7ex;
   padding-bottom: 0.7ex;
 }
@@ -365,7 +365,7 @@ mtable.tml-small mtd {
   math > mrow { padding: 0 }
   /* Adjust Firefox spacing between array rows */
   mtd, mtable.tml-small mtd { padding-top: 0; padding-bottom: 0; }
-  mtable.tml-jot mtd { padding-top: 0.2ex; padding-bottom: 0.ex; }
+  mtable.tml-jot > mtr > mtd { padding-top: 0.2ex; padding-bottom: 0.2ex; }
 }
 
 /* AMS environment auto-numbering via CSS counter. */

package/dist/Temml-Libertinus.css

@@ -346,7 +346,7 @@ math > mrow {
 
 /* Default mtd top padding is 0.5ex per MathML-Core and user-agent CSS */
 /* We adjust for jot and small */
-mtable.tml-jot mtd {
+mtable.tml-jot > mtr > mtd {
   padding-top: 0.7ex;
   padding-bottom: 0.7ex;
 }
@@ -362,7 +362,7 @@ mtable.tml-small mtd {
   math > mrow { padding: 0 }
   /* Adjust Firefox spacing between array rows */
   mtd, mtable.tml-small mtd { padding-top: 0; padding-bottom: 0; }
-  mtable.tml-jot mtd { padding-top: 0.2ex; padding-bottom: 0.ex; }
+  mtable.tml-jot > mtr > mtd { padding-top: 0.2ex; padding-bottom: 0.2ex; }
 }
 
 /* AMS environment auto-numbering via CSS counter. */

package/dist/Temml-Local.css

@@ -342,7 +342,7 @@ math > mrow {
 
 /* Default mtd top padding is 0.5ex per MathML-Core and user-agent CSS */
 /* We adjust for jot and small */
-mtable.tml-jot mtd {
+mtable.tml-jot > mtr > mtd {
   padding-top: 0.7ex;
   padding-bottom: 0.7ex;
 }
@@ -358,7 +358,7 @@ mtable.tml-small mtd {
   math > mrow { padding: 0 }
   /* Adjust Firefox spacing between array rows */
   mtd, mtable.tml-small mtd { padding-top: 0; padding-bottom: 0; }
-  mtable.tml-jot mtd { padding-top: 0.2ex; padding-bottom: 0.ex; }
+  mtable.tml-jot > mtr > mtd { padding-top: 0.2ex; padding-bottom: 0.2ex; }
 }
 
 /* AMS environment auto-numbering via CSS counter. */

package/dist/Temml-NotoSans.css

@@ -346,7 +346,7 @@ math > mrow {
 
 /* Default mtd top padding is 0.5ex per MathML-Core and user-agent CSS */
 /* We adjust for jot and small */
-mtable.tml-jot mtd {
+mtable.tml-jot > mtr > mtd {
   padding-top: 0.7ex;
   padding-bottom: 0.7ex;
 }
@@ -362,7 +362,7 @@ mtable.tml-small mtd {
   math > mrow { padding: 0 }
   /* Adjust Firefox spacing between array rows */
   mtd, mtable.tml-small mtd { padding-top: 0; padding-bottom: 0; }
-  mtable.tml-jot mtd { padding-top: 0.2ex; padding-bottom: 0.ex; }
+  mtable.tml-jot > mtr > mtd { padding-top: 0.2ex; padding-bottom: 0.2ex; }
 }
 
 /* AMS environment auto-numbering via CSS counter. */

package/dist/Temml-STIX2.css

@@ -337,7 +337,7 @@ math > mrow {
 
 /* Default mtd top padding is 0.5ex per MathML-Core and user-agent CSS */
 /* We adjust for jot and small */
-mtable.tml-jot mtd {
+mtable.tml-jot > mtr > mtd {
   padding-top: 0.7ex;
   padding-bottom: 0.7ex;
 }
@@ -353,7 +353,7 @@ mtable.tml-small mtd {
   math > mrow { padding: 0 }
   /* Adjust Firefox spacing between array rows */
   mtd, mtable.tml-small mtd { padding-top: 0; padding-bottom: 0; }
-  mtable.tml-jot mtd { padding-top: 0.2ex; padding-bottom: 0.ex; }
+  mtable.tml-jot > mtr > mtd { padding-top: 0.2ex; padding-bottom: 0.2ex; }
 }
 
 /* AMS environment auto-numbering via CSS counter. */

package/dist/temml.cjs

@@ -70,9 +70,17 @@ ParseError.prototype.__proto__ = Error.prototype;
  */
 
 /**
- * Provide a default value if a setting is undefined
+ * Look up `key` on a user-supplied `options` object and return its value, or
+ * `defaultIfUndefined` if the setting is absent. Reads via
+ * `Object.prototype.hasOwnProperty.call` rather than plain property access,
+ * so a key that only exists because `Object.prototype` was polluted
+ * elsewhere is never mistaken for a setting the caller actually provided.
  */
-const deflt = function(setting, defaultIfUndefined) {
+const deflt = function(options, key, defaultIfUndefined) {
+  if (!Object.prototype.hasOwnProperty.call(options, key)) {
+    return defaultIfUndefined;
+  }
+  const setting = options[key];
   return setting === undefined ? defaultIfUndefined : setting;
 };
 
@@ -190,6 +198,27 @@ const smalls = "acegıȷmnopqrsuvwxyzαγεηικμνοπρςστυχωϕ𝐚
  */
 
 
+const FORBIDDEN_MACRO_KEYS = ["__proto__", "prototype", "constructor"];
+
+// Sanitize a user-supplied macros object: strip its prototype (so later
+// bracket-notation writes, e.g. from \gdef, can never reach Object.prototype)
+// and delete any own key that could be used to pollute it. This mutates
+// `macros` in place and returns the same reference, rather than a copy,
+// because callers such as auto-render.js rely on that identity to share
+// \gdef'd macros across multiple render calls that pass the same options
+// object.
+const sanitizeMacros = (macros) => {
+  if (macros == null || typeof macros !== "object") {
+    return Object.create(null);
+  }
+  for (const key of FORBIDDEN_MACRO_KEYS) {
+    if (Object.prototype.hasOwnProperty.call(macros, key)) {
+      delete macros[key];
+    }
+  }
+  return Object.setPrototypeOf(macros, null);
+};
+
 /**
  * The main Settings object
  */
@@ -197,24 +226,29 @@ class Settings {
   constructor(options) {
     // allow null options
     options = options || {};
-    this.displayMode = deflt(options.displayMode, false);    // boolean
-    this.annotate = deflt(options.annotate, false);           // boolean
-    this.leqno = deflt(options.leqno, false);                // boolean
-    this.throwOnError = deflt(options.throwOnError, false);  // boolean
-    this.errorColor = deflt(options.errorColor, "#b22222");  // string
-    this.macros = options.macros || {};
-    this.wrap = deflt(options.wrap, "none");                   // "none" | "tex" | "="
-    this.xml = deflt(options.xml, false);                     // boolean
-    this.colorIsTextColor = deflt(options.colorIsTextColor, false);  // boolean
-    this.strict = deflt(options.strict, false);    // boolean
-    this.trust = deflt(options.trust, false);  // trust context. See html.js.
-    this.maxSize = (options.maxSize === undefined
-      ? [Infinity, Infinity]
-      : Array.isArray(options.maxSize)
+    this.displayMode = deflt(options, "displayMode", false);    // boolean
+    this.annotate = deflt(options, "annotate", false);           // boolean
+    this.leqno = deflt(options, "leqno", false);                // boolean
+    this.throwOnError = deflt(options, "throwOnError", false);  // boolean
+    this.errorColor = deflt(options, "errorColor", "#b22222");  // string
+    this.macros = sanitizeMacros(
+      Object.prototype.hasOwnProperty.call(options, "macros") ? options.macros : undefined
+    );
+    this.wrap = deflt(options, "wrap", "none");                   // "none" | "tex" | "="
+    this.xml = deflt(options, "xml", false);                     // boolean
+    this.colorIsTextColor = deflt(options, "colorIsTextColor", false);  // boolean
+    this.strict = deflt(options, "strict", false);    // boolean
+    this.trust = deflt(options, "trust", false);  // trust context. See html.js.
+    const maxSize = Object.prototype.hasOwnProperty.call(options, "maxSize")
       ? options.maxSize
+      : undefined;
+    this.maxSize = (maxSize === undefined
+      ? [Infinity, Infinity]
+      : Array.isArray(maxSize)
+      ? maxSize
       : [Infinity, Infinity]
     );
-    this.maxExpand = Math.max(0, deflt(options.maxExpand, 1000)); // number
+    this.maxExpand = Math.max(0, deflt(options, "maxExpand", 1000)); // number
     this.wrapDelimiterPairs = true; // boolean
   }
 
@@ -914,22 +948,26 @@ const NON_ATOMS = {
   textord: 1
 };
 
-const symbols = {
-  math: {},
-  text: {}
-};
+const symbols = Object.create(null);
+symbols.math = Object.create(null);
+symbols.text = Object.create(null);
 
-/** `acceptUnicodeChar = true` is only applicable if `replace` is set. */
 function defineSymbol(mode, group, replace, name, acceptUnicodeChar) {
-  symbols[mode][name] = { group, replace };
+  if (mode !== "math" && mode !== "text") {
+    throw new TypeError(`Invalid mode: ${mode} called in defineSymbol`);
+  }
+
+  const entry = { group, replace };
+  symbols[mode][name] = entry;
 
+  /** `acceptUnicodeChar = true` is only applicable if `replace` is set. */
   if (acceptUnicodeChar && replace) {
-    symbols[mode][replace] = symbols[mode][name];
+    symbols[mode][replace] = entry;
   }
 }
 
 // Some abbreviations for commonly used strings.
-// This helps minify the code, and also spotting typos using jshint.
+// This helps minify the code, and also spotting typos via linter.
 
 // modes:
 const math = "math";
@@ -3559,7 +3597,7 @@ const StyleLevel = {
  * `macros.js` exports this same dictionary again and makes it public.
  * `Parser.js` requires this dictionary via `macros.js`.
  */
-const _macros = {};
+const _macros = Object.create(null);
 
 // This function might one day accept an additional argument and do more things.
 function defineMacro(name, body) {
@@ -12000,7 +12038,7 @@ class Namespace {
    * of initial (global-level) mappings, which will constantly change
    * according to any global/top-level `set`s done.
    */
-  constructor(builtins = {}, globalMacros = {}) {
+  constructor(builtins = Object.create(null), globalMacros = Object.create(null)) {
     this.current = globalMacros;
     this.builtins = builtins;
     this.undefStack = [];
@@ -12010,7 +12048,7 @@ class Namespace {
    * Start a new nested group, affecting future local `set`s.
    */
   beginGroup() {
-    this.undefStack.push({});
+    this.undefStack.push(Object.create(null));
   }
 
   /**
@@ -14208,7 +14246,7 @@ class Style {
  * https://mit-license.org/
  */
 
-const version = "0.13.4";
+const version = "0.13.5";
 
 function postProcess(block) {
   const labelMap = {};
@@ -14529,7 +14567,7 @@ const renderMathInElement = function(elem, options) {
 
   // Enable sharing of global macros defined via `\gdef` between different
   // math elements within a single call to `renderMathInElement`.
-  optionsCopy.macros = optionsCopy.macros || {};
+  optionsCopy.macros = optionsCopy.macros || Object.create(null);
 
   renderElem(elem, optionsCopy);
   postProcess(elem);
@@ -14608,7 +14646,7 @@ const generateParseTree = function(expression, options) {
  */
 const definePreamble = function(expression, options) {
   const settings = new Settings(options);
-  settings.macros = {};
+  settings.macros = Object.create(null);
   if (!(typeof expression === "string" || expression instanceof String)) {
     throw new TypeError("Temml can only parse string typed expression")
   }

package/dist/temml.js

@@ -71,9 +71,17 @@ var temml = (function () {
    */
 
   /**
-   * Provide a default value if a setting is undefined
+   * Look up `key` on a user-supplied `options` object and return its value, or
+   * `defaultIfUndefined` if the setting is absent. Reads via
+   * `Object.prototype.hasOwnProperty.call` rather than plain property access,
+   * so a key that only exists because `Object.prototype` was polluted
+   * elsewhere is never mistaken for a setting the caller actually provided.
    */
-  const deflt = function(setting, defaultIfUndefined) {
+  const deflt = function(options, key, defaultIfUndefined) {
+    if (!Object.prototype.hasOwnProperty.call(options, key)) {
+      return defaultIfUndefined;
+    }
+    const setting = options[key];
     return setting === undefined ? defaultIfUndefined : setting;
   };
 
@@ -191,6 +199,27 @@ var temml = (function () {
    */
 
 
+  const FORBIDDEN_MACRO_KEYS = ["__proto__", "prototype", "constructor"];
+
+  // Sanitize a user-supplied macros object: strip its prototype (so later
+  // bracket-notation writes, e.g. from \gdef, can never reach Object.prototype)
+  // and delete any own key that could be used to pollute it. This mutates
+  // `macros` in place and returns the same reference, rather than a copy,
+  // because callers such as auto-render.js rely on that identity to share
+  // \gdef'd macros across multiple render calls that pass the same options
+  // object.
+  const sanitizeMacros = (macros) => {
+    if (macros == null || typeof macros !== "object") {
+      return Object.create(null);
+    }
+    for (const key of FORBIDDEN_MACRO_KEYS) {
+      if (Object.prototype.hasOwnProperty.call(macros, key)) {
+        delete macros[key];
+      }
+    }
+    return Object.setPrototypeOf(macros, null);
+  };
+
   /**
    * The main Settings object
    */
@@ -198,24 +227,29 @@ var temml = (function () {
     constructor(options) {
       // allow null options
       options = options || {};
-      this.displayMode = deflt(options.displayMode, false);    // boolean
-      this.annotate = deflt(options.annotate, false);           // boolean
-      this.leqno = deflt(options.leqno, false);                // boolean
-      this.throwOnError = deflt(options.throwOnError, false);  // boolean
-      this.errorColor = deflt(options.errorColor, "#b22222");  // string
-      this.macros = options.macros || {};
-      this.wrap = deflt(options.wrap, "none");                   // "none" | "tex" | "="
-      this.xml = deflt(options.xml, false);                     // boolean
-      this.colorIsTextColor = deflt(options.colorIsTextColor, false);  // boolean
-      this.strict = deflt(options.strict, false);    // boolean
-      this.trust = deflt(options.trust, false);  // trust context. See html.js.
-      this.maxSize = (options.maxSize === undefined
-        ? [Infinity, Infinity]
-        : Array.isArray(options.maxSize)
+      this.displayMode = deflt(options, "displayMode", false);    // boolean
+      this.annotate = deflt(options, "annotate", false);           // boolean
+      this.leqno = deflt(options, "leqno", false);                // boolean
+      this.throwOnError = deflt(options, "throwOnError", false);  // boolean
+      this.errorColor = deflt(options, "errorColor", "#b22222");  // string
+      this.macros = sanitizeMacros(
+        Object.prototype.hasOwnProperty.call(options, "macros") ? options.macros : undefined
+      );
+      this.wrap = deflt(options, "wrap", "none");                   // "none" | "tex" | "="
+      this.xml = deflt(options, "xml", false);                     // boolean
+      this.colorIsTextColor = deflt(options, "colorIsTextColor", false);  // boolean
+      this.strict = deflt(options, "strict", false);    // boolean
+      this.trust = deflt(options, "trust", false);  // trust context. See html.js.
+      const maxSize = Object.prototype.hasOwnProperty.call(options, "maxSize")
         ? options.maxSize
+        : undefined;
+      this.maxSize = (maxSize === undefined
+        ? [Infinity, Infinity]
+        : Array.isArray(maxSize)
+        ? maxSize
         : [Infinity, Infinity]
       );
-      this.maxExpand = Math.max(0, deflt(options.maxExpand, 1000)); // number
+      this.maxExpand = Math.max(0, deflt(options, "maxExpand", 1000)); // number
       this.wrapDelimiterPairs = true; // boolean
     }
 
@@ -915,22 +949,26 @@ var temml = (function () {
     textord: 1
   };
 
-  const symbols = {
-    math: {},
-    text: {}
-  };
+  const symbols = Object.create(null);
+  symbols.math = Object.create(null);
+  symbols.text = Object.create(null);
 
-  /** `acceptUnicodeChar = true` is only applicable if `replace` is set. */
   function defineSymbol(mode, group, replace, name, acceptUnicodeChar) {
-    symbols[mode][name] = { group, replace };
+    if (mode !== "math" && mode !== "text") {
+      throw new TypeError(`Invalid mode: ${mode} called in defineSymbol`);
+    }
+
+    const entry = { group, replace };
+    symbols[mode][name] = entry;
 
+    /** `acceptUnicodeChar = true` is only applicable if `replace` is set. */
     if (acceptUnicodeChar && replace) {
-      symbols[mode][replace] = symbols[mode][name];
+      symbols[mode][replace] = entry;
     }
   }
 
   // Some abbreviations for commonly used strings.
-  // This helps minify the code, and also spotting typos using jshint.
+  // This helps minify the code, and also spotting typos via linter.
 
   // modes:
   const math = "math";
@@ -3560,7 +3598,7 @@ var temml = (function () {
    * `macros.js` exports this same dictionary again and makes it public.
    * `Parser.js` requires this dictionary via `macros.js`.
    */
-  const _macros = {};
+  const _macros = Object.create(null);
 
   // This function might one day accept an additional argument and do more things.
   function defineMacro(name, body) {
@@ -10087,7 +10125,7 @@ var temml = (function () {
      * of initial (global-level) mappings, which will constantly change
      * according to any global/top-level `set`s done.
      */
-    constructor(builtins = {}, globalMacros = {}) {
+    constructor(builtins = Object.create(null), globalMacros = Object.create(null)) {
       this.current = globalMacros;
       this.builtins = builtins;
       this.undefStack = [];
@@ -10097,7 +10135,7 @@ var temml = (function () {
      * Start a new nested group, affecting future local `set`s.
      */
     beginGroup() {
-      this.undefStack.push({});
+      this.undefStack.push(Object.create(null));
     }
 
     /**
@@ -12295,7 +12333,7 @@ var temml = (function () {
    * https://mit-license.org/
    */
 
-  const version = "0.13.4";
+  const version = "0.13.5";
 
   function postProcess(block) {
     const labelMap = {};
@@ -12616,7 +12654,7 @@ var temml = (function () {
 
     // Enable sharing of global macros defined via `\gdef` between different
     // math elements within a single call to `renderMathInElement`.
-    optionsCopy.macros = optionsCopy.macros || {};
+    optionsCopy.macros = optionsCopy.macros || Object.create(null);
 
     renderElem(elem, optionsCopy);
     postProcess(elem);
@@ -12695,7 +12733,7 @@ var temml = (function () {
    */
   const definePreamble = function(expression, options) {
     const settings = new Settings(options);
-    settings.macros = {};
+    settings.macros = Object.create(null);
     if (!(typeof expression === "string" || expression instanceof String)) {
       throw new TypeError("Temml can only parse string typed expression")
     }