# Enable safe \href in MathJax

As a follow-up to this discussion, I would like to request the activation of MathJax-safe \href to allow similar URLs to those allowed in [linktext](URL) Markdown.
For more elaboration on the why, see the discussion on the topic in the linked question.

## Posts with many cross-references

Do we know if there exist true mathematical statements that can not be proven?

## Excerpt of discussion:

@Davide But enabling only the url capabilities of \href is completely safe, right? Thus I remain perplexed as to the rationale for disabling this crucial feature. The SE markdown language supports urls outside of MathJax, but not inside of it. I cannot make any sense of that design decision. – Bill Dubuque 15 hours ago

@Bill, If you mean allowing http: and https: URL's, then yes, I believe that to be safe. But URL's in general include things like javascript: URL's, and those are not safe (they can allow any user to capture data about you and send it to their own site for collection, for example). So that is why SE has disabled it. The MathJax safe extension is new in v2.3, so is only recently available. Note that SE only allows restricted URL's in their Markdown (no javascript:, and no relative links, for example). – Davide Cervone 15 hours ago

To boil this down, I suggest a temporary solution if links are really required: Mark the equation using \tag{A} and then include a textual annotation below the math saying [(A)](http://www.example.com) – AlexR 15 hours ago

@Davide Yes, I know that. But, as I said, I request only linking to web pages (http[s]: or, possibly ftp: too), which is no less safe than the capability already offered for such in SE's markdown language (I didn't check if SE supports ftp:). – Bill Dubuque 15 hours ago

@AlexR Yes, that's what I sometimes do, but it's not a good solution because a reader may need to scroll down a few pages to find the link. Also, I want the links to be on existing entities (e.g. arrows $\Rightarrow$ or $\Leftrightarrow$), not on some spurious object that plays no role in the text other than to hold a link. – Bill Dubuque 15 hours ago

@BillDubuque I haven't seen many so-long questions that this would be a burden to me (FullHD solution at least), so I suggest using \stackrel{(ABC)}\Rightarrow as a work-around for the time being. – AlexR 14 hours ago

@AlexR Yes, I do already use variants of that. But it would be much nicer to have first-class links, esp. when that feature is already implemented in MathJax, and requires an abolutely trivial configuration change to enable it on MSE. If you've ever read my posts, you'll notice that they heavily link to others posts and external sources. – Bill Dubuque 14 hours ago

• I would suggest that you summarize the reason for enabling it here, so that not everyone has to read the whole long comment thread. To get SE to change this, I'd add some specific examples on how this capability would be useful and why regular links are sometimes not enough. – user9733 Feb 3 '14 at 13:33
• @MadScientist I'll compile the relevant posts. – AlexR Feb 3 '14 at 13:37
• Do I understand that this is a feature of MathJax 2.3 and later (we are currently at 2.4 beta) that SE has intentionally disabled? The only concern I can think of is whether such links are (more than usually) disguised to the casual Reader. – hardmath Dec 1 '14 at 13:17
• I guess the problem is that the macro is processed in the MathJax engine, and therefore hard to make safe. While Markdown links have to be in a single piece and therefore can be easily checked, I guess the following would work in MathJax and be hard to filter out: \def\B{cript:}\def\A{javas}\href{\A\B alert('malicious code')}{\text{Click here}} Indeed, I suspect the problem of making that safe (without changing theMathJax code itself, which is used from an external source) would be equivalent to the halting problem. – celtschk Feb 22 '17 at 7:23
• @celtschk Well, you could render MathJax on a trusted server and search the output. Of course this would need some Timeout and disable \href if that is exceeded. – AlexR Feb 22 '17 at 7:52