Timeline for Enable safe `\href` in MathJax
Current License: CC BY-SA 3.0
9 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 13, 2022 at 18:54 | comment | added | robjohn Mod |
@celtschk: The link in \href{link}{math} is not processed further, so it would try to open the URL "\A\B alert('malicious code')." Firefox returns the message "Firefox can’t find the file at /A/B alert('malicious code')." Note that the backslashes are turned into forward slashes by the browser as described in the MathJax documentation.
|
|
| Apr 13, 2017 at 12:22 | history | edited | CommunityBot |
replaced http://math.stackexchange.com/ with https://math.stackexchange.com/
|
|
| Feb 22, 2017 at 7:52 | comment | added | AlexR | @celtschk Well, you could render MathJax on a trusted server and search the output. Of course this would need some Timeout and disable \href if that is exceeded. | |
| Feb 22, 2017 at 7:23 | comment | added | celtschk |
I guess the problem is that the macro is processed in the MathJax engine, and therefore hard to make safe. While Markdown links have to be in a single piece and therefore can be easily checked, I guess the following would work in MathJax and be hard to filter out: \def\B{cript:}\def\A{javas}\href{\A\B alert('malicious code')}{\text{Click here}} Indeed, I suspect the problem of making that safe (without changing theMathJax code itself, which is used from an external source) would be equivalent to the halting problem.
|
|
| Dec 1, 2014 at 13:17 | comment | added | hardmath | Do I understand that this is a feature of MathJax 2.3 and later (we are currently at 2.4 beta) that SE has intentionally disabled? The only concern I can think of is whether such links are (more than usually) disguised to the casual Reader. | |
| Feb 3, 2014 at 13:41 | history | edited | AlexR | CC BY-SA 3.0 |
added 2374 characters in body
|
| Feb 3, 2014 at 13:37 | comment | added | AlexR | @MadScientist I'll compile the relevant posts. | |
| Feb 3, 2014 at 13:33 | comment | added | user9733 | I would suggest that you summarize the reason for enabling it here, so that not everyone has to read the whole long comment thread. To get SE to change this, I'd add some specific examples on how this capability would be useful and why regular links are sometimes not enough. | |
| Feb 3, 2014 at 12:37 | history | asked | AlexR | CC BY-SA 3.0 |