temml 0.13.4 → 0.14.0

package/dist/temml.mjs

@@ -68,9 +68,17 @@ ParseError.prototype.__proto__ = Error.prototype;
  */
 
 /**
- * Provide a default value if a setting is undefined
+ * Look up `key` on a user-supplied `options` object and return its value, or
+ * `defaultIfUndefined` if the setting is absent. Reads via
+ * `Object.prototype.hasOwnProperty.call` rather than plain property access,
+ * so a key that only exists because `Object.prototype` was polluted
+ * elsewhere is never mistaken for a setting the caller actually provided.
  */
-const deflt = function(setting, defaultIfUndefined) {
+const deflt = function(options, key, defaultIfUndefined) {
+  if (!Object.prototype.hasOwnProperty.call(options, key)) {
+    return defaultIfUndefined;
+  }
+  const setting = options[key];
   return setting === undefined ? defaultIfUndefined : setting;
 };
 
@@ -188,6 +196,27 @@ const smalls = "acegıȷmnopqrsuvwxyzαγεηικμνοπρςστυχωϕ𝐚
  */
 
 
+const FORBIDDEN_MACRO_KEYS = ["__proto__", "prototype", "constructor"];
+
+// Sanitize a user-supplied macros object: strip its prototype (so later
+// bracket-notation writes, e.g. from \gdef, can never reach Object.prototype)
+// and delete any own key that could be used to pollute it. This mutates
+// `macros` in place and returns the same reference, rather than a copy,
+// because callers such as auto-render.js rely on that identity to share
+// \gdef'd macros across multiple render calls that pass the same options
+// object.
+const sanitizeMacros = (macros) => {
+  if (macros == null || typeof macros !== "object") {
+    return Object.create(null);
+  }
+  for (const key of FORBIDDEN_MACRO_KEYS) {
+    if (Object.prototype.hasOwnProperty.call(macros, key)) {
+      delete macros[key];
+    }
+  }
+  return Object.setPrototypeOf(macros, null);
+};
+
 /**
  * The main Settings object
  */
@@ -195,24 +224,29 @@ class Settings {
   constructor(options) {
     // allow null options
     options = options || {};
-    this.displayMode = deflt(options.displayMode, false);    // boolean
-    this.annotate = deflt(options.annotate, false);           // boolean
-    this.leqno = deflt(options.leqno, false);                // boolean
-    this.throwOnError = deflt(options.throwOnError, false);  // boolean
-    this.errorColor = deflt(options.errorColor, "#b22222");  // string
-    this.macros = options.macros || {};
-    this.wrap = deflt(options.wrap, "none");                   // "none" | "tex" | "="
-    this.xml = deflt(options.xml, false);                     // boolean
-    this.colorIsTextColor = deflt(options.colorIsTextColor, false);  // boolean
-    this.strict = deflt(options.strict, false);    // boolean
-    this.trust = deflt(options.trust, false);  // trust context. See html.js.
-    this.maxSize = (options.maxSize === undefined
-      ? [Infinity, Infinity]
-      : Array.isArray(options.maxSize)
+    this.displayMode = deflt(options, "displayMode", false);    // boolean
+    this.annotate = deflt(options, "annotate", false);           // boolean
+    this.leqno = deflt(options, "leqno", false);                // boolean
+    this.throwOnError = deflt(options, "throwOnError", false);  // boolean
+    this.errorColor = deflt(options, "errorColor", "#b22222");  // string
+    this.macros = sanitizeMacros(
+      Object.prototype.hasOwnProperty.call(options, "macros") ? options.macros : undefined
+    );
+    this.wrap = deflt(options, "wrap", "none");                   // "none" | "tex" | "="
+    this.xml = deflt(options, "xml", false);                     // boolean
+    this.colorIsTextColor = deflt(options, "colorIsTextColor", false);  // boolean
+    this.strict = deflt(options, "strict", false);    // boolean
+    this.trust = deflt(options, "trust", false);  // trust context. See html.js.
+    const maxSize = Object.prototype.hasOwnProperty.call(options, "maxSize")
       ? options.maxSize
+      : undefined;
+    this.maxSize = (maxSize === undefined
+      ? [Infinity, Infinity]
+      : Array.isArray(maxSize)
+      ? maxSize
       : [Infinity, Infinity]
     );
-    this.maxExpand = Math.max(0, deflt(options.maxExpand, 1000)); // number
+    this.maxExpand = Math.max(0, deflt(options, "maxExpand", 1000)); // number
     this.wrapDelimiterPairs = true; // boolean
   }
 
@@ -912,22 +946,26 @@ const NON_ATOMS = {
   textord: 1
 };
 
-const symbols = {
-  math: {},
-  text: {}
-};
+const symbols = Object.create(null);
+symbols.math = Object.create(null);
+symbols.text = Object.create(null);
 
-/** `acceptUnicodeChar = true` is only applicable if `replace` is set. */
 function defineSymbol(mode, group, replace, name, acceptUnicodeChar) {
-  symbols[mode][name] = { group, replace };
+  if (mode !== "math" && mode !== "text") {
+    throw new TypeError(`Invalid mode: ${mode} called in defineSymbol`);
+  }
+
+  const entry = { group, replace };
+  symbols[mode][name] = entry;
 
+  /** `acceptUnicodeChar = true` is only applicable if `replace` is set. */
   if (acceptUnicodeChar && replace) {
-    symbols[mode][replace] = symbols[mode][name];
+    symbols[mode][replace] = entry;
   }
 }
 
 // Some abbreviations for commonly used strings.
-// This helps minify the code, and also spotting typos using jshint.
+// This helps minify the code, and also spotting typos via linter.
 
 // modes:
 const math = "math";
@@ -1765,9 +1803,11 @@ defineSymbol(math, op, "\u222b", "\\smallint");
 defineSymbol(text, inner, "\u2026", "\\textellipsis");
 defineSymbol(math, inner, "\u2026", "\\mathellipsis");
 defineSymbol(text, inner, "\u2026", "\\ldots", true);
+defineSymbol(math, inner, "\u2026", "\\dotso");
+defineSymbol(math, inner, "\u2026", "\\dotsc");
 defineSymbol(math, inner, "\u2026", "\\ldots", true);
 defineSymbol(math, inner, "\u22f0", "\\iddots", true);
-defineSymbol(math, inner, "\u22ef", "\\@cdots", true);
+defineSymbol(math, inner, "\u22ef", "\\cdots", true);
 defineSymbol(math, inner, "\u22f1", "\\ddots", true);
 defineSymbol(math, textord, "\u22ee", "\\varvdots"); // \vdots is a macro
 defineSymbol(text, textord, "\u22ee", "\\varvdots");
@@ -3557,7 +3597,7 @@ const StyleLevel = {
  * `macros.js` exports this same dictionary again and makes it public.
  * `Parser.js` requires this dictionary via `macros.js`.
  */
-const _macros = {};
+const _macros = Object.create(null);
 
 // This function might one day accept an additional argument and do more things.
 function defineMacro(name, body) {
@@ -3902,60 +3942,6 @@ defineMacro("\\dots", function(context) {
   return thedots;
 });
 
-const spaceAfterDots = {
-  // \rightdelim@ checks for the following:
-  ")": true,
-  "]": true,
-  "\\rbrack": true,
-  "\\}": true,
-  "\\rbrace": true,
-  "\\rangle": true,
-  "\\rceil": true,
-  "\\rfloor": true,
-  "\\rgroup": true,
-  "\\rmoustache": true,
-  "\\right": true,
-  "\\bigr": true,
-  "\\biggr": true,
-  "\\Bigr": true,
-  "\\Biggr": true,
-  // \extra@ also tests for the following:
-  $: true,
-  // \extrap@ checks for the following:
-  ";": true,
-  ".": true,
-  ",": true
-};
-
-defineMacro("\\dotso", function(context) {
-  const next = context.future().text;
-  if (next in spaceAfterDots) {
-    return "\\ldots\\,";
-  } else {
-    return "\\ldots";
-  }
-});
-
-defineMacro("\\dotsc", function(context) {
-  const next = context.future().text;
-  // \dotsc uses \extra@ but not \extrap@, instead specially checking for
-  // ';' and '.', but doesn't check for ','.
-  if (next in spaceAfterDots && next !== ",") {
-    return "\\ldots\\,";
-  } else {
-    return "\\ldots";
-  }
-});
-
-defineMacro("\\cdots", function(context) {
-  const next = context.future().text;
-  if (next in spaceAfterDots) {
-    return "\\@cdots\\,";
-  } else {
-    return "\\@cdots";
-  }
-});
-
 defineMacro("\\dotsb", "\\cdots");
 defineMacro("\\dotsm", "\\cdots");
 defineMacro("\\dotsi", "\\!\\cdots");
@@ -4085,7 +4071,7 @@ defineMacro("\\colon", `\\mathpunct{\\char"3a}`);
 //////////////////////////////////////////////////////////////////////
 // mathtools.sty
 
-defineMacro("\\prescript", "\\pres@cript{_{#1}^{#2}}{}{#3}");
+defineMacro("\\prescript", "\\pres@cript{^{#1}_{#2}}{}{#3}");
 
 //\providecommand\ordinarycolon{:}
 defineMacro("\\ordinarycolon", `\\char"3a`);
@@ -11443,6 +11429,11 @@ const isArrow = str => {
 defineFunctionBuilders({
   type: "atom",
   mathmlBuilder(group, style) {
+    if (group.family === "inner") {
+      // Give \dots ORD spacing, not OP spacing.
+      const tag = group.mode === "text" ? "mtext" : "mi";
+      return new MathNode(tag, [makeText(group.text, group.mode)])
+    }
     const node = new MathNode("mo", [makeText(group.text, group.mode)]);
     if (group.family === "punct") {
       node.setAttribute("separator", "true");
@@ -11998,7 +11989,7 @@ class Namespace {
    * of initial (global-level) mappings, which will constantly change
    * according to any global/top-level `set`s done.
    */
-  constructor(builtins = {}, globalMacros = {}) {
+  constructor(builtins = Object.create(null), globalMacros = Object.create(null)) {
     this.current = globalMacros;
     this.builtins = builtins;
     this.undefStack = [];
@@ -12008,7 +11999,7 @@ class Namespace {
    * Start a new nested group, affecting future local `set`s.
    */
   beginGroup() {
-    this.undefStack.push({});
+    this.undefStack.push(Object.create(null));
   }
 
   /**
@@ -14206,7 +14197,7 @@ class Style {
  * https://mit-license.org/
  */
 
-const version = "0.13.4";
+const version = "0.14.0";
 
 function postProcess(block) {
   const labelMap = {};
@@ -14527,7 +14518,7 @@ const renderMathInElement = function(elem, options) {
 
   // Enable sharing of global macros defined via `\gdef` between different
   // math elements within a single call to `renderMathInElement`.
-  optionsCopy.macros = optionsCopy.macros || {};
+  optionsCopy.macros = optionsCopy.macros || Object.create(null);
 
   renderElem(elem, optionsCopy);
   postProcess(elem);
@@ -14606,7 +14597,7 @@ const generateParseTree = function(expression, options) {
  */
 const definePreamble = function(expression, options) {
   const settings = new Settings(options);
-  settings.macros = {};
+  settings.macros = Object.create(null);
   if (!(typeof expression === "string" || expression instanceof String)) {
     throw new TypeError("Temml can only parse string typed expression")
   }

package/dist/temmlPostProcess.js

@@ -11,7 +11,7 @@
    * https://mit-license.org/
    */
 
-  const version = "0.13.4";
+  const version = "0.14.0";
 
   function postProcess(block) {
     const labelMap = {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "temml",
-  "version": "0.13.4",
+  "version": "0.14.0",
   "description": "TeX to MathML conversion in JavaScript.",
   "main": "dist/temml.js",
   "engines": {
@@ -17,7 +17,7 @@
   "homepage": "https://temml.org",
   "repository": {
     "type": "git",
-    "url": "git://github.com/ronkok/Temml"
+    "url": "git+https://github.com/ronkok/Temml.git"
   },
   "packageManager": "yarn@3.3.1",
   "files": [

package/src/Namespace.js

@@ -15,7 +15,7 @@ export default class Namespace {
    * of initial (global-level) mappings, which will constantly change
    * according to any global/top-level `set`s done.
    */
-  constructor(builtins = {}, globalMacros = {}) {
+  constructor(builtins = Object.create(null), globalMacros = Object.create(null)) {
     this.current = globalMacros;
     this.builtins = builtins;
     this.undefStack = [];
@@ -25,7 +25,7 @@ export default class Namespace {
    * Start a new nested group, affecting future local `set`s.
    */
   beginGroup() {
-    this.undefStack.push({});
+    this.undefStack.push(Object.create(null));
   }
 
   /**

package/src/Settings.js

@@ -5,6 +5,27 @@
 
 import * as utils from "./utils";
 
+const FORBIDDEN_MACRO_KEYS = ["__proto__", "prototype", "constructor"];
+
+// Sanitize a user-supplied macros object: strip its prototype (so later
+// bracket-notation writes, e.g. from \gdef, can never reach Object.prototype)
+// and delete any own key that could be used to pollute it. This mutates
+// `macros` in place and returns the same reference, rather than a copy,
+// because callers such as auto-render.js rely on that identity to share
+// \gdef'd macros across multiple render calls that pass the same options
+// object.
+const sanitizeMacros = (macros) => {
+  if (macros == null || typeof macros !== "object") {
+    return Object.create(null);
+  }
+  for (const key of FORBIDDEN_MACRO_KEYS) {
+    if (Object.prototype.hasOwnProperty.call(macros, key)) {
+      delete macros[key];
+    }
+  }
+  return Object.setPrototypeOf(macros, null);
+};
+
 /**
  * The main Settings object
  */
@@ -12,24 +33,29 @@ export default class Settings {
   constructor(options) {
     // allow null options
     options = options || {};
-    this.displayMode = utils.deflt(options.displayMode, false);    // boolean
-    this.annotate = utils.deflt(options.annotate, false)           // boolean
-    this.leqno = utils.deflt(options.leqno, false);                // boolean
-    this.throwOnError = utils.deflt(options.throwOnError, false);  // boolean
-    this.errorColor = utils.deflt(options.errorColor, "#b22222");  // string
-    this.macros = options.macros || {};
-    this.wrap = utils.deflt(options.wrap, "none")                   // "none" | "tex" | "="
-    this.xml = utils.deflt(options.xml, false);                     // boolean
-    this.colorIsTextColor = utils.deflt(options.colorIsTextColor, false);  // boolean
-    this.strict = utils.deflt(options.strict, false);    // boolean
-    this.trust = utils.deflt(options.trust, false);  // trust context. See html.js.
-    this.maxSize = (options.maxSize === undefined
-      ? [Infinity, Infinity]
-      : Array.isArray(options.maxSize)
+    this.displayMode = utils.deflt(options, "displayMode", false);    // boolean
+    this.annotate = utils.deflt(options, "annotate", false)           // boolean
+    this.leqno = utils.deflt(options, "leqno", false);                // boolean
+    this.throwOnError = utils.deflt(options, "throwOnError", false);  // boolean
+    this.errorColor = utils.deflt(options, "errorColor", "#b22222");  // string
+    this.macros = sanitizeMacros(
+      Object.prototype.hasOwnProperty.call(options, "macros") ? options.macros : undefined
+    );
+    this.wrap = utils.deflt(options, "wrap", "none")                   // "none" | "tex" | "="
+    this.xml = utils.deflt(options, "xml", false);                     // boolean
+    this.colorIsTextColor = utils.deflt(options, "colorIsTextColor", false);  // boolean
+    this.strict = utils.deflt(options, "strict", false);    // boolean
+    this.trust = utils.deflt(options, "trust", false);  // trust context. See html.js.
+    const maxSize = Object.prototype.hasOwnProperty.call(options, "maxSize")
       ? options.maxSize
+      : undefined;
+    this.maxSize = (maxSize === undefined
+      ? [Infinity, Infinity]
+      : Array.isArray(maxSize)
+      ? maxSize
       : [Infinity, Infinity]
     )
-    this.maxExpand = Math.max(0, utils.deflt(options.maxExpand, 1000)); // number
+    this.maxExpand = Math.max(0, utils.deflt(options, "maxExpand", 1000)); // number
     this.wrapDelimiterPairs = true; // boolean
   }
 

package/src/auto-render.js

@@ -256,7 +256,7 @@ export const renderMathInElement = function(elem, options) {
 
   // Enable sharing of global macros defined via `\gdef` between different
   // math elements within a single call to `renderMathInElement`.
-  optionsCopy.macros = optionsCopy.macros || {};
+  optionsCopy.macros = optionsCopy.macros || Object.create(null);
 
   renderElem(elem, optionsCopy);
   postProcess(elem);

package/src/defineMacro.js

@@ -3,7 +3,7 @@
  * `macros.js` exports this same dictionary again and makes it public.
  * `Parser.js` requires this dictionary via `macros.js`.
  */
-export const _macros = {};
+export const _macros = Object.create(null);
 
 // This function might one day accept an additional argument and do more things.
 export default function defineMacro(name, body) {

package/src/functions/symbolsOp.js

@@ -21,6 +21,11 @@ const isArrow = str => {
 defineFunctionBuilders({
   type: "atom",
   mathmlBuilder(group, style) {
+    if (group.family === "inner") {
+      // Give \dots ORD spacing, not OP spacing.
+      const tag = group.mode === "text" ? "mtext" : "mi"
+      return new mathMLTree.MathNode(tag, [mml.makeText(group.text, group.mode)])
+    }
     const node = new mathMLTree.MathNode("mo", [mml.makeText(group.text, group.mode)]);
     if (group.family === "punct") {
       node.setAttribute("separator", "true");

package/src/macros.js

@@ -342,60 +342,6 @@ defineMacro("\\dots", function(context) {
   return thedots;
 });
 
-const spaceAfterDots = {
-  // \rightdelim@ checks for the following:
-  ")": true,
-  "]": true,
-  "\\rbrack": true,
-  "\\}": true,
-  "\\rbrace": true,
-  "\\rangle": true,
-  "\\rceil": true,
-  "\\rfloor": true,
-  "\\rgroup": true,
-  "\\rmoustache": true,
-  "\\right": true,
-  "\\bigr": true,
-  "\\biggr": true,
-  "\\Bigr": true,
-  "\\Biggr": true,
-  // \extra@ also tests for the following:
-  $: true,
-  // \extrap@ checks for the following:
-  ";": true,
-  ".": true,
-  ",": true
-};
-
-defineMacro("\\dotso", function(context) {
-  const next = context.future().text;
-  if (next in spaceAfterDots) {
-    return "\\ldots\\,";
-  } else {
-    return "\\ldots";
-  }
-});
-
-defineMacro("\\dotsc", function(context) {
-  const next = context.future().text;
-  // \dotsc uses \extra@ but not \extrap@, instead specially checking for
-  // ';' and '.', but doesn't check for ','.
-  if (next in spaceAfterDots && next !== ",") {
-    return "\\ldots\\,";
-  } else {
-    return "\\ldots";
-  }
-});
-
-defineMacro("\\cdots", function(context) {
-  const next = context.future().text;
-  if (next in spaceAfterDots) {
-    return "\\@cdots\\,";
-  } else {
-    return "\\@cdots";
-  }
-});
-
 defineMacro("\\dotsb", "\\cdots");
 defineMacro("\\dotsm", "\\cdots");
 defineMacro("\\dotsi", "\\!\\cdots");
@@ -525,7 +471,7 @@ defineMacro("\\colon", `\\mathpunct{\\char"3a}`)
 //////////////////////////////////////////////////////////////////////
 // mathtools.sty
 
-defineMacro("\\prescript", "\\pres@cript{_{#1}^{#2}}{}{#3}")
+defineMacro("\\prescript", "\\pres@cript{^{#1}_{#2}}{}{#3}")
 
 //\providecommand\ordinarycolon{:}
 defineMacro("\\ordinarycolon", `\\char"3a`);

package/src/postProcess.js

@@ -5,7 +5,7 @@
  * https://mit-license.org/
  */
 
-export const version = "0.13.4";
+export const version = "0.14.0";
 
 export function postProcess(block) {
   const labelMap = {}

package/src/symbols.js

@@ -33,23 +33,27 @@ export const NON_ATOMS = {
   textord: 1
 };
 
-const symbols = {
-  math: {},
-  text: {}
-};
+const symbols = Object.create(null);
+symbols.math = Object.create(null);
+symbols.text = Object.create(null);
 export default symbols;
 
-/** `acceptUnicodeChar = true` is only applicable if `replace` is set. */
 export function defineSymbol(mode, group, replace, name, acceptUnicodeChar) {
-  symbols[mode][name] = { group, replace };
+  if (mode !== "math" && mode !== "text") {
+    throw new TypeError(`Invalid mode: ${mode} called in defineSymbol`);
+  }
+
+  const entry = { group, replace };
+  symbols[mode][name] = entry;
 
+  /** `acceptUnicodeChar = true` is only applicable if `replace` is set. */
   if (acceptUnicodeChar && replace) {
-    symbols[mode][replace] = symbols[mode][name];
+    symbols[mode][replace] = entry;
   }
 }
 
 // Some abbreviations for commonly used strings.
-// This helps minify the code, and also spotting typos using jshint.
+// This helps minify the code, and also spotting typos via linter.
 
 // modes:
 const math = "math";
@@ -887,9 +891,11 @@ defineSymbol(math, op, "\u222b", "\\smallint");
 defineSymbol(text, inner, "\u2026", "\\textellipsis");
 defineSymbol(math, inner, "\u2026", "\\mathellipsis");
 defineSymbol(text, inner, "\u2026", "\\ldots", true);
+defineSymbol(math, inner, "\u2026", "\\dotso");
+defineSymbol(math, inner, "\u2026", "\\dotsc");
 defineSymbol(math, inner, "\u2026", "\\ldots", true);
 defineSymbol(math, inner, "\u22f0", "\\iddots", true);
-defineSymbol(math, inner, "\u22ef", "\\@cdots", true);
+defineSymbol(math, inner, "\u22ef", "\\cdots", true);
 defineSymbol(math, inner, "\u22f1", "\\ddots", true);
 defineSymbol(math, textord, "\u22ee", "\\varvdots"); // \vdots is a macro
 defineSymbol(text, textord, "\u22ee", "\\varvdots");

package/src/utils.js

@@ -5,9 +5,17 @@
  */
 
 /**
- * Provide a default value if a setting is undefined
+ * Look up `key` on a user-supplied `options` object and return its value, or
+ * `defaultIfUndefined` if the setting is absent. Reads via
+ * `Object.prototype.hasOwnProperty.call` rather than plain property access,
+ * so a key that only exists because `Object.prototype` was polluted
+ * elsewhere is never mistaken for a setting the caller actually provided.
  */
-export const deflt = function(setting, defaultIfUndefined) {
+export const deflt = function(options, key, defaultIfUndefined) {
+  if (!Object.prototype.hasOwnProperty.call(options, key)) {
+    return defaultIfUndefined;
+  }
+  const setting = options[key];
   return setting === undefined ? defaultIfUndefined : setting;
 };
 

package/temml.js

@@ -84,7 +84,7 @@ const generateParseTree = function(expression, options) {
  */
 const definePreamble = function(expression, options) {
   const settings = new Settings(options);
-  settings.macros = {};
+  settings.macros = Object.create(null);
   if (!(typeof expression === "string" || expression instanceof String)) {
     throw new TypeError("Temml can only parse string typed expression")
   }