18

There have already been some proposals to limit MathJax in comments in general, or to inline only. And while this is somewhat connected, it can be extended to answers and questions, too.

I found a way that has the potential to completely ruin most of the MathJax for the following posts. I am certain that such instances will be rare (if ever) and that they could be dealt with individually. However, I see the problem, that someone destroys something completely unintentional. And there is already an easy fix for that.

MathJax provides the functionality to define and redefine commands. The latter is the source of the problem, as you can also redefine defaults. The following screenshot may exaggerate this.

MathJax comment breaks answer

In the above I redefine the \frac command, basically inverting all fractions. (The command itself is invisible.) I know that you need to obtain the privilege to post comments, but we had more determined trolls than that. I am not concerned that this is a big problem, but there is an easy fix for this.

The Mathjax configuration should load begingroup and issue a $\begingroup$ at the beginning and a $\endgroup$ at the end of each post, keeping defined macros local. To guard against malicious comments it might be worthwhile considering doing the same for comments, although I cannot judge how that would affect load times.

5
  • 7
    This has long been a concern on Mathematics: The scope of \newcommand is the entire page, and Using the Begingroup Extension of MathJax?.
    – user642796
    Commented Feb 3, 2017 at 11:47
  • Isn't it easy for a troll to get around auto-injection of \xgroup by just including \endgroup at the start of their post? Mm... I guess each other piece of content would be encapsulated in its own \xgroup commands... but if someone redefined, e.g., \frac, effectively globally as you do in your example, wouldn't that propagate as the default into the 'subscopes'?
    – hBy2Py
    Commented Feb 6, 2017 at 4:41
  • 2
    A quick test question confirms that, yes, redefining defaults at the page-level scope does propagate into the group-ed blocks. grouping will protect against newcommand leakage into other Jax, but cannot protect against malicious top-level redefinition of defaults.
    – hBy2Py
    Commented Feb 6, 2017 at 4:57
  • 2
    This was changed in January 2019. (Although it broke some of the existing posts/existing comments, but that's for a separate discussion.) The change is also mentioned in this list: Recent feature changes to Stack Exchange.
    – Martin
    Commented Feb 12, 2020 at 8:46
  • @Martin Thank you for the information, I wouldn't have looked otherwise. Commented Feb 12, 2020 at 10:14

0

You must log in to answer this question.

Browse other questions tagged .