temml 0.13.4 → 0.13.5

package/dist/temml.mjs

@@ -68,9 +68,17 @@ ParseError.prototype.__proto__ = Error.prototype;
  */
 
 /**
- * Provide a default value if a setting is undefined
+ * Look up `key` on a user-supplied `options` object and return its value, or
+ * `defaultIfUndefined` if the setting is absent. Reads via
+ * `Object.prototype.hasOwnProperty.call` rather than plain property access,
+ * so a key that only exists because `Object.prototype` was polluted
+ * elsewhere is never mistaken for a setting the caller actually provided.
  */
-const deflt = function(setting, defaultIfUndefined) {
+const deflt = function(options, key, defaultIfUndefined) {
+  if (!Object.prototype.hasOwnProperty.call(options, key)) {
+    return defaultIfUndefined;
+  }
+  const setting = options[key];
   return setting === undefined ? defaultIfUndefined : setting;
 };
 
@@ -188,6 +196,27 @@ const smalls = "acegıȷmnopqrsuvwxyzαγεηικμνοπρςστυχωϕ𝐚
  */
 
 
+const FORBIDDEN_MACRO_KEYS = ["__proto__", "prototype", "constructor"];
+
+// Sanitize a user-supplied macros object: strip its prototype (so later
+// bracket-notation writes, e.g. from \gdef, can never reach Object.prototype)
+// and delete any own key that could be used to pollute it. This mutates
+// `macros` in place and returns the same reference, rather than a copy,
+// because callers such as auto-render.js rely on that identity to share
+// \gdef'd macros across multiple render calls that pass the same options
+// object.
+const sanitizeMacros = (macros) => {
+  if (macros == null || typeof macros !== "object") {
+    return Object.create(null);
+  }
+  for (const key of FORBIDDEN_MACRO_KEYS) {
+    if (Object.prototype.hasOwnProperty.call(macros, key)) {
+      delete macros[key];
+    }
+  }
+  return Object.setPrototypeOf(macros, null);
+};
+
 /**
  * The main Settings object
  */
@@ -195,24 +224,29 @@ class Settings {
   constructor(options) {
     // allow null options
     options = options || {};
-    this.displayMode = deflt(options.displayMode, false);    // boolean
-    this.annotate = deflt(options.annotate, false);           // boolean
-    this.leqno = deflt(options.leqno, false);                // boolean
-    this.throwOnError = deflt(options.throwOnError, false);  // boolean
-    this.errorColor = deflt(options.errorColor, "#b22222");  // string
-    this.macros = options.macros || {};
-    this.wrap = deflt(options.wrap, "none");                   // "none" | "tex" | "="
-    this.xml = deflt(options.xml, false);                     // boolean
-    this.colorIsTextColor = deflt(options.colorIsTextColor, false);  // boolean
-    this.strict = deflt(options.strict, false);    // boolean
-    this.trust = deflt(options.trust, false);  // trust context. See html.js.
-    this.maxSize = (options.maxSize === undefined
-      ? [Infinity, Infinity]
-      : Array.isArray(options.maxSize)
+    this.displayMode = deflt(options, "displayMode", false);    // boolean
+    this.annotate = deflt(options, "annotate", false);           // boolean
+    this.leqno = deflt(options, "leqno", false);                // boolean
+    this.throwOnError = deflt(options, "throwOnError", false);  // boolean
+    this.errorColor = deflt(options, "errorColor", "#b22222");  // string
+    this.macros = sanitizeMacros(
+      Object.prototype.hasOwnProperty.call(options, "macros") ? options.macros : undefined
+    );
+    this.wrap = deflt(options, "wrap", "none");                   // "none" | "tex" | "="
+    this.xml = deflt(options, "xml", false);                     // boolean
+    this.colorIsTextColor = deflt(options, "colorIsTextColor", false);  // boolean
+    this.strict = deflt(options, "strict", false);    // boolean
+    this.trust = deflt(options, "trust", false);  // trust context. See html.js.
+    const maxSize = Object.prototype.hasOwnProperty.call(options, "maxSize")
       ? options.maxSize
+      : undefined;
+    this.maxSize = (maxSize === undefined
+      ? [Infinity, Infinity]
+      : Array.isArray(maxSize)
+      ? maxSize
       : [Infinity, Infinity]
     );
-    this.maxExpand = Math.max(0, deflt(options.maxExpand, 1000)); // number
+    this.maxExpand = Math.max(0, deflt(options, "maxExpand", 1000)); // number
     this.wrapDelimiterPairs = true; // boolean
   }
 
@@ -912,22 +946,26 @@ const NON_ATOMS = {
   textord: 1
 };
 
-const symbols = {
-  math: {},
-  text: {}
-};
+const symbols = Object.create(null);
+symbols.math = Object.create(null);
+symbols.text = Object.create(null);
 
-/** `acceptUnicodeChar = true` is only applicable if `replace` is set. */
 function defineSymbol(mode, group, replace, name, acceptUnicodeChar) {
-  symbols[mode][name] = { group, replace };
+  if (mode !== "math" && mode !== "text") {
+    throw new TypeError(`Invalid mode: ${mode} called in defineSymbol`);
+  }
+
+  const entry = { group, replace };
+  symbols[mode][name] = entry;
 
+  /** `acceptUnicodeChar = true` is only applicable if `replace` is set. */
   if (acceptUnicodeChar && replace) {
-    symbols[mode][replace] = symbols[mode][name];
+    symbols[mode][replace] = entry;
   }
 }
 
 // Some abbreviations for commonly used strings.
-// This helps minify the code, and also spotting typos using jshint.
+// This helps minify the code, and also spotting typos via linter.
 
 // modes:
 const math = "math";
@@ -3557,7 +3595,7 @@ const StyleLevel = {
  * `macros.js` exports this same dictionary again and makes it public.
  * `Parser.js` requires this dictionary via `macros.js`.
  */
-const _macros = {};
+const _macros = Object.create(null);
 
 // This function might one day accept an additional argument and do more things.
 function defineMacro(name, body) {
@@ -11998,7 +12036,7 @@ class Namespace {
    * of initial (global-level) mappings, which will constantly change
    * according to any global/top-level `set`s done.
    */
-  constructor(builtins = {}, globalMacros = {}) {
+  constructor(builtins = Object.create(null), globalMacros = Object.create(null)) {
     this.current = globalMacros;
     this.builtins = builtins;
     this.undefStack = [];
@@ -12008,7 +12046,7 @@ class Namespace {
    * Start a new nested group, affecting future local `set`s.
    */
   beginGroup() {
-    this.undefStack.push({});
+    this.undefStack.push(Object.create(null));
   }
 
   /**
@@ -14206,7 +14244,7 @@ class Style {
  * https://mit-license.org/
  */
 
-const version = "0.13.4";
+const version = "0.13.5";
 
 function postProcess(block) {
   const labelMap = {};
@@ -14527,7 +14565,7 @@ const renderMathInElement = function(elem, options) {
 
   // Enable sharing of global macros defined via `\gdef` between different
   // math elements within a single call to `renderMathInElement`.
-  optionsCopy.macros = optionsCopy.macros || {};
+  optionsCopy.macros = optionsCopy.macros || Object.create(null);
 
   renderElem(elem, optionsCopy);
   postProcess(elem);
@@ -14606,7 +14644,7 @@ const generateParseTree = function(expression, options) {
  */
 const definePreamble = function(expression, options) {
   const settings = new Settings(options);
-  settings.macros = {};
+  settings.macros = Object.create(null);
   if (!(typeof expression === "string" || expression instanceof String)) {
     throw new TypeError("Temml can only parse string typed expression")
   }

package/dist/temmlPostProcess.js

@@ -11,7 +11,7 @@
    * https://mit-license.org/
    */
 
-  const version = "0.13.4";
+  const version = "0.13.5";
 
   function postProcess(block) {
     const labelMap = {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "temml",
-  "version": "0.13.4",
+  "version": "0.13.5",
   "description": "TeX to MathML conversion in JavaScript.",
   "main": "dist/temml.js",
   "engines": {

package/src/Namespace.js

@@ -15,7 +15,7 @@ export default class Namespace {
    * of initial (global-level) mappings, which will constantly change
    * according to any global/top-level `set`s done.
    */
-  constructor(builtins = {}, globalMacros = {}) {
+  constructor(builtins = Object.create(null), globalMacros = Object.create(null)) {
     this.current = globalMacros;
     this.builtins = builtins;
     this.undefStack = [];
@@ -25,7 +25,7 @@ export default class Namespace {
    * Start a new nested group, affecting future local `set`s.
    */
   beginGroup() {
-    this.undefStack.push({});
+    this.undefStack.push(Object.create(null));
   }
 
   /**

package/src/Settings.js

@@ -5,6 +5,27 @@
 
 import * as utils from "./utils";
 
+const FORBIDDEN_MACRO_KEYS = ["__proto__", "prototype", "constructor"];
+
+// Sanitize a user-supplied macros object: strip its prototype (so later
+// bracket-notation writes, e.g. from \gdef, can never reach Object.prototype)
+// and delete any own key that could be used to pollute it. This mutates
+// `macros` in place and returns the same reference, rather than a copy,
+// because callers such as auto-render.js rely on that identity to share
+// \gdef'd macros across multiple render calls that pass the same options
+// object.
+const sanitizeMacros = (macros) => {
+  if (macros == null || typeof macros !== "object") {
+    return Object.create(null);
+  }
+  for (const key of FORBIDDEN_MACRO_KEYS) {
+    if (Object.prototype.hasOwnProperty.call(macros, key)) {
+      delete macros[key];
+    }
+  }
+  return Object.setPrototypeOf(macros, null);
+};
+
 /**
  * The main Settings object
  */
@@ -12,24 +33,29 @@ export default class Settings {
   constructor(options) {
     // allow null options
     options = options || {};
-    this.displayMode = utils.deflt(options.displayMode, false);    // boolean
-    this.annotate = utils.deflt(options.annotate, false)           // boolean
-    this.leqno = utils.deflt(options.leqno, false);                // boolean
-    this.throwOnError = utils.deflt(options.throwOnError, false);  // boolean
-    this.errorColor = utils.deflt(options.errorColor, "#b22222");  // string
-    this.macros = options.macros || {};
-    this.wrap = utils.deflt(options.wrap, "none")                   // "none" | "tex" | "="
-    this.xml = utils.deflt(options.xml, false);                     // boolean
-    this.colorIsTextColor = utils.deflt(options.colorIsTextColor, false);  // boolean
-    this.strict = utils.deflt(options.strict, false);    // boolean
-    this.trust = utils.deflt(options.trust, false);  // trust context. See html.js.
-    this.maxSize = (options.maxSize === undefined
-      ? [Infinity, Infinity]
-      : Array.isArray(options.maxSize)
+    this.displayMode = utils.deflt(options, "displayMode", false);    // boolean
+    this.annotate = utils.deflt(options, "annotate", false)           // boolean
+    this.leqno = utils.deflt(options, "leqno", false);                // boolean
+    this.throwOnError = utils.deflt(options, "throwOnError", false);  // boolean
+    this.errorColor = utils.deflt(options, "errorColor", "#b22222");  // string
+    this.macros = sanitizeMacros(
+      Object.prototype.hasOwnProperty.call(options, "macros") ? options.macros : undefined
+    );
+    this.wrap = utils.deflt(options, "wrap", "none")                   // "none" | "tex" | "="
+    this.xml = utils.deflt(options, "xml", false);                     // boolean
+    this.colorIsTextColor = utils.deflt(options, "colorIsTextColor", false);  // boolean
+    this.strict = utils.deflt(options, "strict", false);    // boolean
+    this.trust = utils.deflt(options, "trust", false);  // trust context. See html.js.
+    const maxSize = Object.prototype.hasOwnProperty.call(options, "maxSize")
       ? options.maxSize
+      : undefined;
+    this.maxSize = (maxSize === undefined
+      ? [Infinity, Infinity]
+      : Array.isArray(maxSize)
+      ? maxSize
       : [Infinity, Infinity]
     )
-    this.maxExpand = Math.max(0, utils.deflt(options.maxExpand, 1000)); // number
+    this.maxExpand = Math.max(0, utils.deflt(options, "maxExpand", 1000)); // number
     this.wrapDelimiterPairs = true; // boolean
   }
 

package/src/auto-render.js

@@ -256,7 +256,7 @@ export const renderMathInElement = function(elem, options) {
 
   // Enable sharing of global macros defined via `\gdef` between different
   // math elements within a single call to `renderMathInElement`.
-  optionsCopy.macros = optionsCopy.macros || {};
+  optionsCopy.macros = optionsCopy.macros || Object.create(null);
 
   renderElem(elem, optionsCopy);
   postProcess(elem);

package/src/defineMacro.js

@@ -3,7 +3,7 @@
  * `macros.js` exports this same dictionary again and makes it public.
  * `Parser.js` requires this dictionary via `macros.js`.
  */
-export const _macros = {};
+export const _macros = Object.create(null);
 
 // This function might one day accept an additional argument and do more things.
 export default function defineMacro(name, body) {

package/src/postProcess.js

@@ -5,7 +5,7 @@
  * https://mit-license.org/
  */
 
-export const version = "0.13.4";
+export const version = "0.13.5";
 
 export function postProcess(block) {
   const labelMap = {}

package/src/symbols.js

@@ -33,23 +33,27 @@ export const NON_ATOMS = {
   textord: 1
 };
 
-const symbols = {
-  math: {},
-  text: {}
-};
+const symbols = Object.create(null);
+symbols.math = Object.create(null);
+symbols.text = Object.create(null);
 export default symbols;
 
-/** `acceptUnicodeChar = true` is only applicable if `replace` is set. */
 export function defineSymbol(mode, group, replace, name, acceptUnicodeChar) {
-  symbols[mode][name] = { group, replace };
+  if (mode !== "math" && mode !== "text") {
+    throw new TypeError(`Invalid mode: ${mode} called in defineSymbol`);
+  }
+
+  const entry = { group, replace };
+  symbols[mode][name] = entry;
 
+  /** `acceptUnicodeChar = true` is only applicable if `replace` is set. */
   if (acceptUnicodeChar && replace) {
-    symbols[mode][replace] = symbols[mode][name];
+    symbols[mode][replace] = entry;
   }
 }
 
 // Some abbreviations for commonly used strings.
-// This helps minify the code, and also spotting typos using jshint.
+// This helps minify the code, and also spotting typos via linter.
 
 // modes:
 const math = "math";

package/src/utils.js

@@ -5,9 +5,17 @@
  */
 
 /**
- * Provide a default value if a setting is undefined
+ * Look up `key` on a user-supplied `options` object and return its value, or
+ * `defaultIfUndefined` if the setting is absent. Reads via
+ * `Object.prototype.hasOwnProperty.call` rather than plain property access,
+ * so a key that only exists because `Object.prototype` was polluted
+ * elsewhere is never mistaken for a setting the caller actually provided.
  */
-export const deflt = function(setting, defaultIfUndefined) {
+export const deflt = function(options, key, defaultIfUndefined) {
+  if (!Object.prototype.hasOwnProperty.call(options, key)) {
+    return defaultIfUndefined;
+  }
+  const setting = options[key];
   return setting === undefined ? defaultIfUndefined : setting;
 };
 

package/temml.js

@@ -84,7 +84,7 @@ const generateParseTree = function(expression, options) {
  */
 const definePreamble = function(expression, options) {
   const settings = new Settings(options);
-  settings.macros = {};
+  settings.macros = Object.create(null);
   if (!(typeof expression === "string" || expression instanceof String)) {
     throw new TypeError("Temml can only parse string typed expression")
   }