{"action":"created","issue":{"url":"https://api.github.com/repos/mathjax/MathJax-node/issues/279","repository_url":"https://api.github.com/repos/mathjax/MathJax-node","labels_url":"https://api.github.com/repos/mathjax/MathJax-node/issues/279/labels{/name}","comments_url":"https://api.github.com/repos/mathjax/MathJax-node/issues/279/comments","events_url":"https://api.github.com/repos/mathjax/MathJax-node/issues/279/events","html_url":"https://github.com/mathjax/MathJax-node/issues/279","id":190699730,"number":279,"title":"configure jsdom to block remote resources","user":{"login":"pkra","id":426686,"avatar_url":"https://avatars.githubusercontent.com/u/426686?v=3","gravatar_id":"","url":"https://api.github.com/users/pkra","html_url":"https://github.com/pkra","followers_url":"https://api.github.com/users/pkra/followers","following_url":"https://api.github.com/users/pkra/following{/other_user}","gists_url":"https://api.github.com/users/pkra/gists{/gist_id}","starred_url":"https://api.github.com/users/pkra/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pkra/subscriptions","organizations_url":"https://api.github.com/users/pkra/orgs","repos_url":"https://api.github.com/users/pkra/repos","events_url":"https://api.github.com/users/pkra/events{/privacy}","received_events_url":"https://api.github.com/users/pkra/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/mathjax/MathJax-node/milestones/3","html_url":"https://github.com/mathjax/MathJax-node/milestones/What%20comes%20next%20--%20towards%20v1.0","labels_url":"https://api.github.com/repos/mathjax/MathJax-node/milestones/3/labels","id":1590228,"number":3,"title":"What comes next -- towards v1.0","description":"Stuff for the next release.","creator":{"login":"pkra","id":426686,"avatar_url":"https://avatars.githubusercontent.com/u/426686?v=3","gravatar_id":"","url":"https://api.github.com/users/pkra","html_url":"https://github.com/pkra","followers_url":"https://api.github.com/users/pkra/followers","following_url":"https://api.github.com/users/pkra/following{/other_user}","gists_url":"https://api.github.com/users/pkra/gists{/gist_id}","starred_url":"https://api.github.com/users/pkra/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pkra/subscriptions","organizations_url":"https://api.github.com/users/pkra/orgs","repos_url":"https://api.github.com/users/pkra/repos","events_url":"https://api.github.com/users/pkra/events{/privacy}","received_events_url":"https://api.github.com/users/pkra/received_events","type":"User","site_admin":false},"open_issues":4,"closed_issues":29,"state":"open","created_at":"2016-02-18T08:52:05Z","updated_at":"2016-11-21T12:14:55Z","due_on":null,"closed_at":null},"comments":5,"created_at":"2016-11-21T12:14:55Z","updated_at":"2016-11-22T20:00:33Z","closed_at":null,"body":"From the discussion of [#134](https://github.com/mathjax/MathJax-node/issues/134#issuecomment-261920746), we currently do not [prevent remote resources](https://github.com/tmpvar/jsdom#external-resources) from being loaded into the jsdom window (e.g., via the MathJax configuration) this is [a security risk](https://github.com/tmpvar/jsdom#on-running-scripts-and-being-safe). "},"comment":{"url":"https://api.github.com/repos/mathjax/MathJax-node/issues/comments/262349297","html_url":"https://github.com/mathjax/MathJax-node/issues/279#issuecomment-262349297","issue_url":"https://api.github.com/repos/mathjax/MathJax-node/issues/279","id":262349297,"user":{"login":"dpvc","id":432782,"avatar_url":"https://avatars.githubusercontent.com/u/432782?v=3","gravatar_id":"","url":"https://api.github.com/users/dpvc","html_url":"https://github.com/dpvc","followers_url":"https://api.github.com/users/dpvc/followers","following_url":"https://api.github.com/users/dpvc/following{/other_user}","gists_url":"https://api.github.com/users/dpvc/gists{/gist_id}","starred_url":"https://api.github.com/users/dpvc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dpvc/subscriptions","organizations_url":"https://api.github.com/users/dpvc/orgs","repos_url":"https://api.github.com/users/dpvc/repos","events_url":"https://api.github.com/users/dpvc/events{/privacy}","received_events_url":"https://api.github.com/users/dpvc/received_events","type":"User","site_admin":false},"created_at":"2016-11-22T20:00:33Z","updated_at":"2016-11-22T20:00:33Z","body":"> I was thinking of a web service that allows users to send a configuration as well (e.g., to handle different math delimiters).\r\n\r\nSince the new `main.js` only handles one equation at a time, and these are not delimited, there is no reason to set the delimiters (and if you do, it will screw up `mathjax-node`).  Any handling of delimiters is now supposed to be done by the calling application, so is not up to `mathjax-node`.\r\n\r\nAlso, I would not expect such a service to pass an unfiltered configuration into MathJax, but would take the configuration given to the service and make a new configuration for MathJax from that.  Allowing arbitrary configuration parameters would allow the client to completely disable MathJax (regardless of whether we allow external resources).  Certainly I would not expect to allow arbitrary values in the extension arrays in such a situation.  Moreover, in order to allow such reconfiguration (that included extensions) you would need to start a new copy of MathJax each time the configuration changed, which would be pretty inefficient, and is not well supported by `mathjax-node` currently.\r\n\r\n> That was what I was thinking about. Maybe that's too simplistic.\r\n\r\nBetter than nothing, I guess, though I think your problematic use-case is a stretch.\r\n\r\n> I think the risk is greater because MathJax (on the client) lives in a much safer sandbox\r\n\r\nIf someone could hijack MathJax to execute code in the browser, that would be a very serious issue indeed.  This would allow the page to submit forms, for example, or change cookies, or investigate the local storage or window history or any number of other nefarious things (most of which are an issue in `mathjax-node`).  The fact that it could not access your filling system is good, but not the only security issue.  Plus people who run web services know they are running a service that accepts (possibly evil) data from the world, and should know a little something about the security of the tools they use; general users of browsers certainly are not going to aware of these issues."}}
{"actor":{"display_login":"dpvc"}}