• ## Discussion Feed

Vanilla 1.1.9 is a product of Lussumo. More Information: Documentation, Community Support.

1.
The fun thing: \newcommand{\bla}{\bla} \bla
The bad thing: It works.
(A troll friend of mine used this to kill a chat channel which was running MathJax.)
2.
Although I'm no fan of security through obscurity, the moment Anton told me on some other meta thread that I could use \newcommand in answers (to save me from having to type \mathbf a lot) I realised one could probably do this---but I didn't mention it here. On the other hand, assuming you're right, of course it's only a matter of time before someone tries it...
3.
I *have* tried it and it worked. Have deleted the "question", of course. There is also \def .
MathJax probably has never been developed with a forum in view...
• CommentAuthorMariano
• CommentTimeDec 28th 2010

What is the scope of a definition? The whole html page?

4.

I've created an issue on the MathJax issue tracker. I'm not sure there's a good solution to this problem aside from simply disabling \newcommand and \def. This problem will also crash LaTeX (at least the implementation I have installed right now).

What is the scope of a definition? The whole html page?

I think it's everything on the page below where the definition is made.

• CommentAuthorMariano
• CommentTimeDec 28th 2010

A limit on stack length during expansion should not be that hard to implement, and would not impair essentially no sensible latex expression on MO.

(If we could limit the scope of definitions to an answer, for example, we could all start pasting our favorite latex prologue when writing an answer... :) )

5.

Davide has implemented a limit on the number of macro substitutions and a limit on the size of the string after substitution:

MAXMACROS: 10000,    // maximum number of macro substitutions per equation
MAXBUFFER: 5*1024    // maximum size of TeX string to process


Faketestsite is currently running the branch with the fix, but MO is not. I invite you all to go experiment on Faketestsite to see if you can cause trouble of find unexpected behavior.

I've noted at the issue tracker one way to still cause a fair amount of trouble with \newcommand.

• CommentAuthorMariano
• CommentTimeJan 4th 2011

Are those tunable by sites? I am pretty sure that anything with 20 macro substitutions in an equation in MO is evil...

6.

Yes, they're tunable. I agree that 20 is probably a sufficiently big number for MAXMACROS.

7.

The fix is now running on MO. You're welcome to go type $\newcommand{\x}{\x}\x$ in and see what happens (though you should clear your cache first, and it would really be better for you to run such experiments at faketestsite). I've brought MAXMACROS down from 10000 to a more conservative 50. If this ever turns out to be too small, we can make it bigger.

One thing that wasn't clear to me before was the meaning of MAXMACROS. It's the cap on the maximum number of macros that will be expanded in any given formula. So you might exceed the cap of 50 as follows:


Consider the 11-tuple of groups $(\Zp,\Zp,\Zp,\Zp,\Zp,\Zp,\Zp,\Zp,\Zp,\Zp,\Zp)$

Each \Zp results in five macro expansions:
one to convert \Zp in to \Z/p\Z,
two more to convert \Z/p\Z into \mathbb Z/p\mathbb Z, and
two more to conver \mathbb Z/p\mathbb Z into {\bbFont Z}/p{\bbFont Z}

The single formula with 11 instances of \Zp results in 55 macro expansions, so that formula breaks.

• CommentAuthorMariano
• CommentTimeJan 6th 2011 edited

Allowing \renewcommand, for example, is just asking for trouble. See http://faketestsite.stackexchange.com/questions/151/let-me-test-mathjax I wonder if there is a sensible subset that could be allowed in public fora...

8.


9.

What if you put it in a comment on the original question? Wouldn't that appear above any answer?

10.

Yes, it would, but you'd have to earn enough rep to comment first.

11.

True, I was just pedantically pointing out minor details. I suspect that the chance of this being used as a weapon against MO is very slight.

What worries me more is the probability of someone copying over all their basic macros and making the site slow to an absolute crawl for the rest of us.
