7
$\begingroup$

As a follow-up to this discussion, I would like to request the activation of MathJax-safe \href to allow similar URLs to those allowed in [linktext](URL) Markdown.
For more elaboration on the why, see the discussion on the topic in the linked question.

Posts with many cross-references

Do we know if there exist true mathematical statements that can not be proven?

Excerpt of discussion:

@Davide But enabling only the url capabilities of \href is completely safe, right? Thus I remain perplexed as to the rationale for disabling this crucial feature. The SE markdown language supports urls outside of MathJax, but not inside of it. I cannot make any sense of that design decision. – Bill Dubuque 15 hours ago

@Bill, If you mean allowing http: and https: URL's, then yes, I believe that to be safe. But URL's in general include things like javascript: URL's, and those are not safe (they can allow any user to capture data about you and send it to their own site for collection, for example). So that is why SE has disabled it. The MathJax safe extension is new in v2.3, so is only recently available. Note that SE only allows restricted URL's in their Markdown (no javascript:, and no relative links, for example). – Davide Cervone 15 hours ago

To boil this down, I suggest a temporary solution if links are really required: Mark the equation using \tag{A} and then include a textual annotation below the math saying [(A)](http://www.example.com) – AlexR 15 hours ago

@Davide Yes, I know that. But, as I said, I request only linking to web pages (http[s]: or, possibly ftp: too), which is no less safe than the capability already offered for such in SE's markdown language (I didn't check if SE supports ftp:). – Bill Dubuque 15 hours ago

@AlexR Yes, that's what I sometimes do, but it's not a good solution because a reader may need to scroll down a few pages to find the link. Also, I want the links to be on existing entities (e.g. arrows $\Rightarrow$ or $\Leftrightarrow$), not on some spurious object that plays no role in the text other than to hold a link. – Bill Dubuque 15 hours ago

@BillDubuque I haven't seen many so-long questions that this would be a burden to me (FullHD solution at least), so I suggest using \stackrel{(ABC)}\Rightarrow as a work-around for the time being. – AlexR 14 hours ago

@AlexR Yes, I do already use variants of that. But it would be much nicer to have first-class links, esp. when that feature is already implemented in MathJax, and requires an abolutely trivial configuration change to enable it on MSE. If you've ever read my posts, you'll notice that they heavily link to others posts and external sources. – Bill Dubuque 14 hours ago

$\endgroup$
6
  • 2
    $\begingroup$ I would suggest that you summarize the reason for enabling it here, so that not everyone has to read the whole long comment thread. To get SE to change this, I'd add some specific examples on how this capability would be useful and why regular links are sometimes not enough. $\endgroup$
    – user9733
    Commented Feb 3, 2014 at 13:33
  • $\begingroup$ @MadScientist I'll compile the relevant posts. $\endgroup$
    – AlexR
    Commented Feb 3, 2014 at 13:37
  • $\begingroup$ Do I understand that this is a feature of MathJax 2.3 and later (we are currently at 2.4 beta) that SE has intentionally disabled? The only concern I can think of is whether such links are (more than usually) disguised to the casual Reader. $\endgroup$
    – hardmath
    Commented Dec 1, 2014 at 13:17
  • $\begingroup$ I guess the problem is that the macro is processed in the MathJax engine, and therefore hard to make safe. While Markdown links have to be in a single piece and therefore can be easily checked, I guess the following would work in MathJax and be hard to filter out: \def\B{cript:}\def\A{javas}\href{\A\B alert('malicious code')}{\text{Click here}} Indeed, I suspect the problem of making that safe (without changing theMathJax code itself, which is used from an external source) would be equivalent to the halting problem. $\endgroup$
    – celtschk
    Commented Feb 22, 2017 at 7:23
  • $\begingroup$ @celtschk Well, you could render MathJax on a trusted server and search the output. Of course this would need some Timeout and disable \href if that is exceeded. $\endgroup$
    – AlexR
    Commented Feb 22, 2017 at 7:52
  • $\begingroup$ @celtschk: The link in \href{link}{math} is not processed further, so it would try to open the URL "\A\B alert('malicious code')." Firefox returns the message "Firefox can’t find the file at /A/B alert('malicious code')." Note that the backslashes are turned into forward slashes by the browser as described in the MathJax documentation. $\endgroup$
    – robjohn Mod
    Commented Aug 13, 2022 at 18:54

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .