Execution of unrelated Object.prototype methods by TeX parser
Created by: sergey-o
When given the TeX input \toString
, MathJax internally calls Object.prototype.toString
as a control sequence "handler" instead of reporting an error. This happens for any property name defined in Object.prototype
and is caused by missing hasOwnProperty
checks in lookups (here, for instance).
Examples of other problematic constructs: \begin{toString}\end{toString}
, \cfrac[toString]ab
.