16

There have already been some proposals to limit MathJax in comments in general, or to inline only. And while this is somewhat connected, it can be extended to answers and questions, too.

I found a way that has the potential to completely ruin most of the MathJax for the following posts. I am certain that such instances will be rare (if ever) and that they could be dealt with individually. However, I see the problem, that someone destroys something completely unintentional. And there is already an easy fix for that.

MathJax provides the functionality to define and redefine commands. The latter is the source of the problem, as you can also redefine defaults. The following screenshot may exaggerate this.

MathJax comment breaks answer

In the above I redefine the \frac command, basically inverting all fractions. (The command itself is invisible.) I know that you need to obtain the privilege to post comments, but we had more determined trolls than that. I am not concerned that this is a big problem, but there is an easy fix for this.

The Mathjax configuration should load begingroup and issue a $\begingroup$ at the beginning and a $\endgroup$ at the end of each post, keeping defined macros local. To guard against malicious comments it might be worthwhile considering doing the same for comments, although I cannot judge how that would affect load times.

  • 6
  • Isn't it easy for a troll to get around auto-injection of \xgroup by just including \endgroup at the start of their post? Mm... I guess each other piece of content would be encapsulated in its own \xgroup commands... but if someone redefined, e.g., \frac, effectively globally as you do in your example, wouldn't that propagate as the default into the 'subscopes'? – hBy2Py Feb 6 '17 at 4:41
  • 1
    A quick test question confirms that, yes, redefining defaults at the page-level scope does propagate into the group-ed blocks. grouping will protect against newcommand leakage into other Jax, but cannot protect against malicious top-level redefinition of defaults. – hBy2Py Feb 6 '17 at 4:57

You must log in to answer this question.

Browse other questions tagged .