Scan report
gohugoio / hugo
Could an attacker exploit mistakes in this code?
Serious issues. Review the high-severity findings before using it.
- High
- 8
- Medium
- 89
- Low
- 0
Sources: Bandit, Semgrep, pip-audit
Does this code look like it is trying to cause harm?
Minor issues. Worth a glance, unlikely to be urgent.
- High
- 6
- Medium
- 1
- Low
- 2
Sources: YARA, ClamAV, GuardDog, dependency checker
- Likely real
- 68
- Uncertain
- 31
- Likely noise
- 7
The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.
What we found, in plain English
This repository has a high vulnerability risk score of 231.0, which means there are many insecure coding patterns that an attacker could exploit to break your application. The most serious issues involve missing mutex locks that can cause the program to crash unexpectedly, using functions meant for finding paths instead of sanitizing them from user input, and running commands directly without verifying what is passed to them. While some findings suggest potential malicious intent, the majority appear to be standard insecure practices rather than signs of a hidden attack. The code also contains several other medium-risk issues related to regular expression usage and memory safety that could lead to crashes or denial-of-service attacks if not fixed.
Written by a local language model from the findings below. The risk scores come from the classifier, not from this summary.
Detections by engine
Score over time
Overall score each time this repository was scanned.
Findings
Highest severity first. Select a finding to see the code and what it means.
-
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /hugolib/filesystems/basefs.go line 100
- Likely real
- Yes, 99% confidence
Missing mutex unlock (`f.mu` variable) before returning from a function. This could result in panics resulting from double lock operations
return func() { f.mu.Unlock() }, nil -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /commands/server.go line 321
- Likely real
- Yes, 77% confidence
`Clean` is not intended to sanitize against path traversal attacks. This function is for finding the shortest path name equivalent to the given input. Using `Clean` to sanitize file reads may expose this application to path traversal attacks, where an attacker could access arbitrary files on the server. To fix this easily, write this: `filepath.FromSlash(path.Clean("/"+strings.Trim(req.URL.Path, "/")))` However, a better solution is using the `SecureJoin` function in the package `filepath-securejoin`. See https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme.
path := filepath.Clean(strings.TrimPrefix(requestURI, baseURL.Path())) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /common/hexec/exec.go line 542
- Likely real
- Uncertain, 46% confidence
Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.
cmd = exec.CommandContext(c.ctx, bin, args...) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /common/hexec/exec.go line 544
- Likely real
- Uncertain, 46% confidence
Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.
cmd = exec.Command(bin, args...) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /markup/rst/convert.go line 140
- Likely real
- Uncertain, 46% confidence
Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.
if err := exec.Command(python, "-c", "import pygments").Run(); err == nil { -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /tpl/internal/go_templates/testenv/exec.go line 74
- Likely real
- Uncertain, 46% confidence
Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.
cmd := exec.Command(exe, "-test.list=^$") -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /tpl/internal/go_templates/testenv/exec.go line 205
- Likely real
- Uncertain, 46% confidence
Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.
cmd := exec.CommandContext(ctx, name, args...) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /tpl/internal/go_templates/testenv/testenv.go line 267
- Likely real
- Uncertain, 46% confidence
Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.
cmd := exec.Command(goTool, "env", "CGO_ENABLED") -
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /hugolib/testdata/redis.cn.md
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /.github/workflows/test.yml
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /internal/warpc/js/renderkatex.bundle.js
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tpl/internal/go_templates/htmltemplate/html.go
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tpl/internal/go_templates/htmltemplate/escape.go
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /livereload/livereload.js
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together
-
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /livereload/livereload.js line 1587
- Likely real
- Yes, 100% confidence
RegExp() called with a `regexp` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS.
return fn !== undefined ? fn.call(regexp, O) : new RegExp(regexp)[MATCH](String(O)); -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /livereload/livereload.js line 1779
- Likely real
- Yes, 100% confidence
RegExp() called with a `separator` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS.
var separatorCopy = new RegExp(separator.source, flags + 'g'); -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /common/hugio/copy.go line 41
- Likely real
- Yes, 100% confidence
Variable `si` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference
si, err := fs.Stat(from) if err != nil { err = fs.Chmod(to, si.Mode()) if err != nil { return err } } -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /commands/convert.go line 153
- Likely real
- Yes, 100% confidence
Variable `file` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference
file, err := f.FileInfo().Meta().Open() if err != nil { site.Log.Errorln(errMsg) file.Close() return nil } -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /tpl/strings/truncate.go line 154
- Likely real
- Yes, 100% confidence
Found a formatted template string passed to 'template.HTML()'. 'template.HTML()' does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability.
return template.HTML(html.EscapeString(out.String()) + ellipsis), nil -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /resources/page/hugoinfo.go line 58
- Likely real
- Yes, 100% confidence
Found a formatted template string passed to 'template.HTML()'. 'template.HTML()' does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability.
return template.HTML(fmt.Sprintf(`<meta name="generator" content="Hugo %s">`, hugo.CurrentVersion.String())) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /internal/warpc/genavif/avif.c line 324
- Likely real
- Yes, 100% confidence
Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions.
blob_data = malloc((size_t)blob_size); -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /internal/warpc/genwebp/webp.c line 576
- Likely real
- Yes, 100% confidence
Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions.
blob_data = malloc((size_t)blob_size); -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /htesting/hqt/checkers.go line 169
- Likely real
- Yes, 100% confidence
Iteration over a possibly empty map `m`. This is likely a bug or redundant code
m := make(map[reflect.Type]struct{}) for _, v := range vs { structTypes(reflect.ValueOf(v), m) } var typs []any for t := range m { typs = append(typs, reflect.New(t).Elem().Interface()) } -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /internal/warpc/js/renderkatex.bundle.js line 253
- Likely real
- Yes, 99% confidence
`t.envName.replace` method will only replace the first occurrence when used with a string argument ("*"). If this method is used for escaping of dangerous data then there is a possibility for a bypass. Try to use sanitization library instead or use a Regex with a global flag.
`+G+" children.");for(var K=0;K<G;K++){var p0=new M0(I[K]),n0=new S0([p0],{width:"400em",height:M(F),viewBox:"0 0 "+m+" "+L,preserveAspectRatio:X[K]+" slice"}),B0=X0([V[K]],[n0],r);if(G===1)return{span:B0,minWidth:R,height:F};B0.style.height=M(F),C.push(B0)}return{span:k(["katex-stretchy"],C,r),minWidth:R,height:F}}}var n=a(),s=n.span,o=n.minWidth,c=n.height;return s.height=c,s.style.height=M(c),o>0&&(s.style.minWidth=M(o)),s},j1=function(e,r,a,n,s){var o,c=e.height+e.depth+a+n;if(/fbox|color|angl/.test(r)){if(o=k(["katex-stretchy",r],[],s),r==="fbox"){var m=s.color&&s.getColor();m&&(o.style.borderColor=m)}}else{var d=[];/^[bx]cancel$/.test(r)&&d.push(new ge({x1:"0",y1:"0",x2:"100%",y2:"100%","stroke-width":"0.046em"})),/^x?cancel$/.test(r)&&d.push(new ge({x1:"0",y1:"100%",x2:"100%",y2:"0","stroke-width":"0.046em"}));var v=new S0(d,{width:"100%",height:M(c)});o=X0([],[v],s)}return o.height=c,o.style.height=M(c),o},Y1=["bin","close","inner","open","punct","rel"],Z1=["accent-token","mathord","op-token","spacing","textord"],K1=new Set(Y1),J1=new Set(Z1);function Q1(t){return K1.has(t)}function H(t,e){if(!t||t.type!==e)throw new Error("Expected node of type "+e+", but got "+(t?"node of type "+t.type:String(t)));return t}function Ze(t){var e=Ke(t);if(!e)throw new Error("Expected node of symbol group type, but got "+(t?"node of type "+t.type:String(t)));return e}function Ke(t){return t.type==="atom"||J1.has(t.type)?t:null}function Vt(t,e,r){var a="";for(var n of t.body)if(n.type==="textord")a+=n.text;else if(r&&n.type==="spacing"&&n.text===" ")a+=" ";else throw new z(e,t);return a}var la=t=>{if(t instanceof h0)return t;if(k1(t)&&t.children.length===1)return la(t.children[0])},oa=(t,e)=>{var r,a,n;t&&t.type==="supsub"?(a=H(t.base,"accent"),r=a.base,t.base=r,n=S1(U(t,e)),t.base=a):(a=H(t,"accent"),r=a.base);var s=U(r,e.havingCrampedStyle()),o=a.isShifty&&I0(r),c=0;if(o){var m,d;c=(m=(d=la(s))==null?void 0:d.skew)!=null?m:0}var v=a.label==="\\c",b=v?s.height+s.depth:Math.min(s.height,e.fontMetrics().xHeight),y;if(a.isStretchy)y=Ye(a,e),y=P({positionType:"firstBaseline",children:[{type:"elem",elem:s},{type:"elem",elem:y,wrapperClasses:["svg-align"],wrapperStyle:c>0?{width:"calc(100% - "+M(2*c)+")",marginLeft:M(2*c)}:void 0}]});else{var x,T;a.label==="\\vec"?(x=ta("vec",e),T=ea.vec[1]):(x=We({type:"textord",mode:a.mode,text:a.label},e),x=w1(x),x.italic=0,T=x.width,v&&(b+=x.depth)),y=k(["accent-body"],[x]);var q=a.label==="\\textcircled";q&&(y.classes.push("accent-full"),b=s.height);var D=c;q||(D-=T/2),y.style.left=M(D),a.label==="\\textcircled"&&(y.style.top=".2em"),y=P({positionType:"firstBaseline",children:[{type:"elem",elem:s},{type:"kern",size:-b},{type:"elem",elem:y}]})}var C=k(["mord","katex-accent"],[y],e);return n?(n.children[0]=C,n.height=Math.max(C.height,n.height),n.classes[0]="mord",n):C},en=(t,e)=>{var r=t.isStretchy?je(t.label):new A("mo",[y0(t.label,t.mode)]),a=new A("mover",[W(t.base,e),r]);return a.setAttribute("accent","true"),a},tn=new RegExp(["\\acute","\\grave","\\ddot","\\tilde","\\bar","\\breve","\\check","\\hat","\\vec","\\dot","\\mathring"].map(t=>"\\"+t).join("|"));B({type:"accent",names:["\\acute","\\grave","\\ddot","\\tilde","\\bar","\\breve","\\check","\\hat","\\vec","\\dot","\\mathring","\\widecheck","\\widehat","\\widetilde","\\overrightarrow","\\overleftarrow","\\Overrightarrow","\\overleftrightarrow","\\overgroup","\\overlinesegment","\\overleftharpoon","\\overrightharpoon"],numArgs:1,handler:(t,e)=>{var r=xe(e[0]),a=!tn.test(t.funcName),n=!a||t.funcName==="\\widehat"||t.funcName==="\\widetilde"||t.funcName==="\\widecheck";return{type:"accent",mode:t.parser.mode,label:t.funcName,isStretchy:a,isShifty:n,base:r}},htmlBuilder:oa,mathmlBuilder:en});B({type:"accent",names:["\\'","\\`","\\^","\\~","\\=","\\u","\\.",'\\"',"\\c","\\r","\\H","\\v","\\textcircled"],numArgs:1,allowedInText:!0,allowedInMath:!0,argTypes:["primitive"],handler:(t,e)=>{var r=e[0],a=t.parser.mode;return a==="math"&&(t.parser.settings.reportNonstrict("mathVsTextAccents","LaTeX's accent "+t.funcName+" works only in text mode"),a="text"),{type:"accent",mode:a,label:t.funcName,isStretchy:!1,isShifty:!0,base:r}}});B({type:"accentUnder",names:["\\underleftarrow","\\underrightarrow","\\underleftrightarrow","\\undergroup","\\underlinesegment","\\utilde"],numArgs:1,handler:(t,e)=>{var r=t.parser,a=t.funcName,n=e[0];return{type:"accentUnder",mode:r.mode,label:a,base:n}},htmlBuilder:(t,e)=>{var r=U(t.base,e),a=Ye(t,e),n=t.label==="\\utilde"?.12:0,s=P({positionType:"top",positionData:r.height,children:[{type:"elem",elem:a,wrapperClasses:["svg-align"]},{type:"kern",size:n},{type:"elem",elem:r}]});return k(["mord","accentunder"],[s],e)},mathmlBuilder:(t,e)=>{var r=je(t.label),a=new A("munder",[W(t.base,e),r]);return a.setAttribute("accentunder","true"),a}});var Ie=t=>{var e=new A("mpadded",t?[t]:[]);return e.setAttribute("width","+0.6em"),e.setAttribute("lspace","0.3em"),e};B({type:"xArrow",names:["\\xleftarrow","\\xrightarrow","\\xLeftarrow","\\xRightarrow","\\xleftrightarrow","\\xLeftrightarrow","\\xhookleftarrow","\\xhookrightarrow","\\xmapsto","\\xrightharpoondown","\\xrightharpoonup","\\xleftharpoondown","\\xleftharpoonup","\\xrightleftharpoons","\\xleftrightharpoons","\\xlongequal","\\xtwoheadrightarrow","\\xtwoheadleftarrow","\\xtofrom","\\xrightleftarrows","\\xrightequilibrium","\\xleftequilibrium","\\\\cdrightarrow","\\\\cdleftarrow","\\\\cdlongequal"],numArgs:1,numOptionalArgs:1,handler(t,e,r){var a=t.parser,n=t.funcName;return{type:"xArrow",mode:a.mode,label:n,body:e[0],below:r[0]}},htmlBuilder(t,e){var r=e.style,a=e.havingStyle(r.sup()),n=le(U(t.body,a,e),e),s=t.label.slice(0,2)==="\\x"?"x":"cd";n.classes.push(s+"-arrow-pad");var o;t.below&&(a=e.havingStyle(r.sub()),o=le(U(t.below,a,e),e),o.classes.push(s+"-arrow-pad"));var c=Ye(t,e),m=-e.fontMetrics().axisHeight+.5*c.height,d=-e.fontMetrics().axisHeight-.5*c.height-.111;(n.depth>.25||t.label==="\\xleftequilibrium")&&(d-=n.depth);var v;if(o){var b=-e.fontMetrics().axisHeight+o.height+.5*c.height+.111;v=P({positionType:"individualShift",children:[{type:"elem",elem:n,shift:d},{type:"elem",elem:c,shift:m,wrapperClasses:["svg-align"]},{type:"elem",elem:o,shift:b}]})}else v=P({positionType:"individualShift",children:[{type:"elem",elem:n,shift:d},{type:"elem",elem:c,shift:m,wrapperClasses:["svg-align"]}]});return k(["mrel","x-arrow"],[v],e)},mathmlBuilder(t,e){var r=je(t.label);r.setAttribute("minsize",t.label.charAt(0)==="x"?"1.75em":"3.0em");var a;if(t.body){var n=Ie(W(t.body,e));if(t.below){var s=Ie(W(t.below,e));a=new A("munderover",[r,s,n])}else a=new A("mover",[r,n])}else if(t.below){var o=Ie(W(t.below,e));a=new A("munder",[r,o])}else a=Ie(),a=new A("mover",[r,a]);return a}});function rn(t,e){var r=s0(t.body,e,!0);return k([t.mclass],r,e)}function an(t,e){var r,a=g0(t.body,e);return t.mclass==="minner"?r=new A("mpadded",a):t.mclass==="mord"?t.isCharacterBox?(r=a[0],r.type="mi"):r=new A("mi",a):(t.isCharacterBox?(r=a[0],r.type="mo"):r=new A("mo",a),t.mclass==="mbin"?(r.attributes.lspace="0.22em",r.attributes.rspace="0.22em"):t.mclass==="mpunct"?(r.attributes.lspace="0em",r.attributes.rspace="0.17em"):(t.mclass==="mopen"||t.mclass==="mclose")&&(r.attributes.lspace="0em",r.attributes.rspace="0em")),r}B({type:"mclass",names:["\\mathord","\\mathbin","\\mathrel","\\mathopen","\\mathclose","\\mathpunct","\\mathinner"],numArgs:1,primitive:!0,handler(t,e){var r=t.parser,a=t.funcName,n=e[0];return{type:"mclass",mode:r.mode,mclass:"m"+a.slice(5),body:r0(n),isCharacterBox:I0(n)}},htmlBuilder:rn,mathmlBuilder:an});var Je=t=>{var e=t.type==="ordgroup"&&t.body.length?t.body[0]:t;return e.type==="atom"&&(e.family==="bin"||e.family==="rel")?"m"+e.family:"mord"};B({type:"mclass",names:["\\@binrel"],numArgs:2,handler(t,e){var r=t.parser;return{type:"mclass",mode:r.mode,mclass:Je(e[0]),body:r0(e[1]),isCharacterBox:I0(e[1])}}});B({type:"mclass",names:["\\stackrel","\\overset","\\underset"],numArgs:2,handler(t,e){var r=t.parser,a=t.funcName,n=e[1],s=e[0],o;a!=="\\stackrel"?o=Je(n):o="mrel";var c={type:"op",mode:n.mode,limits:!0,alwaysHandleSupSub:!0,parentIsSupSub:!1,symbol:!1,suppressBaseShift:a!=="\\stackrel",body:r0(n)},m=a==="\\underset"?{type:"supsub",mode:s.mode,base:c,sub:s}:{type:"supsub",mode:s.mode,base:c,sup:s};return{type:"mclass",mode:r.mode,mclass:o,body:[m],isCharacterBox:I0(m)}}});B({type:"pmb",names:["\\pmb"],numArgs:1,allowedInText:!0,handler(t,e){var r=t.parser;return{type:"pmb",mode:r.mode,mclass:Je(e[0]),body:r0(e[0])}},htmlBuilder(t,e){var r=s0(t.body,e,!0),a=k([t.mclass],r,e);return a.style.textShadow="0.02em 0.01em 0.04px",a},mathmlBuilder(t,e){var r=g0(t.body,e),a=new A("mstyle",r);return a.setAttribute("style","text-shadow: 0.02em 0.01em 0.04px"),a}});var nn={">":"\\\\cdrightarrow","<":"\\\\cdleftarrow","=":"\\\\cdlongequal",A:"\\uparrow",V:"\\downarrow","|":"\\Vert",".":"no arrow"},kr=()=>({type:"styling",body:[],mode:"math",style:"display",resetFont:!0}),zr=t=>t.type==="textord"&&t.text==="@",sn=(t,e)=>(t.type==="mathord"||t.type==="atom")&&t.text===e;function ln(t,e,r){var a=nn[t];switch(a){case"\\\\cdrightarrow":case"\\\\cdleftarrow":return r.callFunction(a,[e[0]],[e[1]]);case"\\uparrow":case"\\downarrow":{var n=r.callFunction("\\\\cdleft",[e[0]],[]),s={type:"atom",text:a,mode:"math",family:"rel"},o=r.callFunction("\\Big",[s],[]),c=r.callFunction("\\\\cdright",[e[1]],[]),m={type:"ordgroup",mode:"math",body:[n,o,c]};return r.callFunction("\\\\cdparent",[m],[])}case"\\\\cdlongequal":return r.callFunction("\\\\cdlongequal",[],[]);case"\\Vert":{var d={type:"textord",text:"\\Vert",mode:"math"};return r.callFunction("\\Big",[d],[])}default:return{type:"textord",text:" ",mode:"math"}}}function on(t){var e=[];for(t.gullet.beginGroup(),t.gullet.macros.set("\\cr","\\\\\\relax"),t.gullet.beginGroup();;){e.push(t.parseExpression(!1,"\\\\")),t.gullet.endGroup(),t.gullet.beginGroup();var r=t.fetch().text;if(r==="&"||r==="\\\\")t.consume();else if(r==="\\end"){e[e.length-1].length===0&&e.pop();break}else throw new z("Expected \\\\ or \\cr or \\end",t.nextToken)}for(var a=[],n=[a],s=0;s<e.length;s++){for(var o=e[s],c=kr(),m=0;m<o.length;m++)if(!zr(o[m]))c.body.push(o[m]);else{a.push(c),m+=1;var d=Ze(o[m]).text,v=new Array(2);if(v[0]={type:"ordgroup",mode:"math",body:[]},v[1]={type:"ordgroup",mode:"math",body:[]},!"=|.".includes(d))if("<>AV".includes(d))for(var b=0;b<2;b++){for(var y=!0,x=m+1;x<o.length;x++){if(sn(o[x],d)){y=!1,m=x;break}if(zr(o[x]))throw new z("Missing a "+d+" character to complete a CD arrow.",o[x]);v[b].body.push(o[x])}if(y)throw new z("Missing a "+d+" character to complete a CD arrow.",o[m])}else throw new z('Expected one of "<>AV=|." after @',o[m]);var T=ln(d,v,t),q={type:"styling",body:[T],mode:"math",style:"display",resetFont:!0};a.push(q),c=kr()}s%2===0?a.push(c):a.shift(),a=[],n.push(a)}t.gullet.endGroup(),t.gullet.endGroup();var D=new Array(n[0].length).fill({type:"align",align:"c",pregap:.25,postgap:.25});return{type:"array",mode:"math",body:n,arraystretch:1,addJot:!0,rowGaps:[null],cols:D,colSeparationType:"CD",hLinesBeforeRow:new Array(n.length+1).fill([])}}B({type:"cdlabel",names:["\\\\cdleft","\\\\cdright"],numArgs:1,handler(t,e){var r=t.parser,a=t.funcName;return{type:"cdlabel",mode:r.mode,side:a.slice(4),label:e[0]}},htmlBuilder(t,e){var r=e.havingStyle(e.style.sup()),a=le(U(t.label,r,e),e);return a.classes.push("cd-label-"+t.side),a.style.bottom=M(.8-a.depth),a.height=0,a.depth=0,a},mathmlBuilder(t,e){var r=new A("mrow",[W(t.label,e)]);return r=new A("mpadded",[r]),r.setAttribute("width","0"),t.side==="left"&&r.setAttribute("lspace","-1width"),r.setAttribute("voffset","0.7em"),r=new A("mstyle",[r]),r.setAttribute("displaystyle","false"),r.setAttribute("scriptlevel","1"),r}});B({type:"cdlabelparent",names:["\\\\cdparent"],numArgs:1,handler(t,e){var r=t.parser;return{type:"cdlabelparent",mode:r.mode,fragment:e[0]}},htmlBuilder(t,e){var r=le(U(t.fragment,e),e);return r.classes.push("cd-vert-arrow"),r},mathmlBuilder(t,e){return new A("mrow",[W(t.fragment,e)])}});B({type:"textord",names:["\\@char"],numArgs:1,allowedInText:!0,handler(t,e){var r=t.parser,a=H(e[0],"ordgroup"),n=Vt(a,"\\@char has non-numeric argument"),s=parseInt(n),o;if(isNaN(s))throw new z("\\@char has non-numeric argument "+n);if(s<0||s>=1114111)throw new z("\\@char with invalid code point "+n);return s<=65535?o=String.fromCharCode(s):(s-=65536,o=String.fromCharCode((s>>10)+55296,(s&1023)+56320)),{type:"textord",mode:r.mode,text:o}}});var un=(t,e)=>{var r=s0(t.body,e.withColor(t.color),!1);return $0(r)},cn=(t,e)=>{var r=g0(t.body,e.withColor(t.color)),a=new A("mstyle",r);return a.setAttribute("mathcolor",t.color),a};B({type:"color",names:["\\textcolor"],numArgs:2,allowedInText:!0,argTypes:["color","original"],handler(t,e){var r=t.parser,a=H(e[0],"color-token").color,n=e[1];return{type:"color",mode:r.mode,color:a,body:r0(n)}},htmlBuilder:un,mathmlBuilder:cn});B({type:"color",names:["\\color"],numArgs:1,allowedInText:!0,argTypes:["color"],handler(t,e){var r=t.parser,a=t.breakOnTokenText,n=H(e[0],"color-token").color;r.gullet.macros.set("\\current@color",n);var s=r.parseExpression(!0,a);return{type:"color",mode:r.mode,color:n,body:s}}});B({type:"cr",names:["\\\\"],numArgs:0,numOptionalArgs:0,allowedInText:!0,handler(t,e,r){var a=t.parser,n=a.gullet.future().text==="["?a.parseSizeGroup(!0):null,s=!a.settings.displayMode||!a.settings.useStrictBehavior("newLineInDisplayMode","In LaTeX, \\\\ or \\newline does nothing in display mode");return{type:"cr",mode:a.mode,newLine:s,size:n&&H(n,"size").value}},htmlBuilder(t,e){var r=k(["mspace"],[],e);return t.newLine&&(r.classes.push("katex-newline"),t.size&&(r.style.marginTop=M(e0(t.size,e)))),r},mathmlBuilder(t,e){var r=new A("mspace");return t.newLine&&(r.setAttribute("linebreak","newline"),t.size&&r.setAttribute("height",M(e0(t.size,e)))),r}});var Bt={"\\global":"\\global","\\long":"\\\\globallong","\\\\globallong":"\\\\globallong","\\def":"\\gdef","\\gdef":"\\gdef","\\edef":"\\xdef","\\xdef":"\\xdef","\\let":"\\\\globallet","\\futurelet":"\\\\globalfuture"},ua=t=>{var e=t.text;if(/^(?:[\\{}$&#^_]|EOF)$/.test(e))throw new z("Expected a control sequence",t);return e},hn=t=>{var e=t.gullet.popToken();return e.text==="="&&(e=t.gullet.popToken(),e.text===" "&&(e=t.gullet.popToken())),e},ca=(t,e,r,a)=>{var n=t.gullet.macros.get(r.text);n==null&&(r.noexpand=!0,n={tokens:[r],numArgs:0,unexpandable:!t.gullet.isExpandable(r.text)}),t.gullet.macros.set(e,n,a)};B({type:"internal",names:["\\global","\\long","\\\\globallong"],numArgs:0,allowedInText:!0,handler(t){var e=t.parser,r=t.funcName;e.consumeSpaces();var a=e.fetch();if(Bt[a.text])return(r==="\\global"||r==="\\\\globallong")&&(a.text=Bt[a.text]),H(e.parseFunction(),"internal");throw new z("Invalid token after macro prefix",a)}});B({type:"internal",names:["\\def","\\gdef","\\edef","\\xdef"],numArgs:0,allowedInText:!0,primitive:!0,handler(t){var e=t.parser,r=t.funcName,a=e.gullet.popToken(),n=a.text;if(/^(?:[\\{}$&#^_]|EOF)$/.test(n))throw new z("Expected a control sequence",a);for(var s=0,o,c=[[]];e.gullet.future().text!=="{";)if(a=e.gullet.popToken(),a.text==="#"){if(e.gullet.future().text==="{"){o=e.gullet.future(),c[s].push("{");break}if(a=e.gullet.popToken(),!/^[1-9]$/.test(a.text))throw new z('Invalid argument number "'+a.text+'"');if(parseInt(a.text)!==s+1)throw new z('Argument number "'+a.text+'" out of order');s++,c.push([])}else{if(a.text==="EOF")throw new z("Expected a macro definition");c[s].push(a.text)}var m=e.gullet.consumeArg(),d=m.tokens;return o&&d.unshift(o),(r==="\\edef"||r==="\\xdef")&&(d=e.gullet.expandTokens(d),d.reverse()),e.gullet.macros.set(n,{tokens:d,numArgs:s,delimiters:c},r===Bt[r]),{type:"internal",mode:e.mode}}});B({type:"internal",names:["\\let","\\\\globallet"],numArgs:0,allowedInText:!0,primitive:!0,handler(t){var e=t.parser,r=t.funcName,a=ua(e.gullet.popToken());e.gullet.consumeSpaces();var n=hn(e);return ca(e,a,n,r==="\\\\globallet"),{type:"internal",mode:e.mode}}});B({type:"internal",names:["\\futurelet","\\\\globalfuture"],numArgs:0,allowedInText:!0,primitive:!0,handler(t){var e=t.parser,r=t.funcName,a=ua(e.gullet.popToken()),n=e.gullet.popToken(),s=e.gullet.popToken();return ca(e,a,s,r==="\\\\globalfuture"),e.gullet.pushToken(s),e.gullet.pushToken(n),{type:"internal",mode:e.mode}}});var de=function(e,r,a){var n=Y.math[e]&&Y.math[e].replace,s=Ht(n||e,r,a);if(!s)throw new Error("Unsupported symbol "+e+" and font size "+r+".");return s},Xt=function(e,r,a,n){var s=a.havingBaseStyle(r),o=k(n.concat(s.sizingClasses(a)),[e],a),c=s.sizeMultiplier/a.sizeMultiplier;return o.height*=c,o.depth*=c,o.maxFontSize=s.sizeMultiplier,o},ha=function(e,r,a){var n=r.havingBaseStyle(a),s=(1-r.sizeMultiplier/n.sizeMultiplier)*r.fontMetrics().axisHeight;e.classes.push("delimcenter"),e.style.top=M(s),e.height-=s,e.depth+=s},mn=function(e,r,a,n,s,o){var c=u0(e,"Main-Regular",s,n),m=Xt(c,r,n,o);return a&&ha(m,n,r),m},dn=function(e,r,a,n){return u0(e,"Size"+r+"-Regular",a,n)},ma=function(e,r,a,n,s,o){var c=dn(e,r,s,n),m=Xt(k(["delimsizing","size"+r],[c],n),$.TEXT,n,o);return a&&ha(m,n,$.TEXT),m},ut=function(e,r,a){var n;r==="Size1-Regular"?n="delim-size1":n="delim-size4";var s=k(["delimsizinginner",n],[k([],[u0(e,r,a)])]);return{type:"elem",elem:s}},ct=function(e,r,a){var n=T0["Size4-Regular"][e.charCodeAt(0)]?T0["Size4-Regular"][e.charCodeAt(0)][4]:T0["Size1-Regular"][e.charCodeAt(0)][4],s=new M0("inner",f1(e,Math.round(1e3*r))),o=new S0([s],{width:M(n),height:M(r),style:"width:"+M(n),viewBox:"0 0 "+1e3*n+" "+Math.round(1e3*r),preserveAspectRatio:"xMinYMin"}),c=X0([],[o],a);return c.height=r,c.style.height=M(r),c.style.width=M(n),{type:"elem",elem:c}},Et=.008,Ne={type:"kern",size:-1*Et},pn=new Set(["|","\\lvert","\\rvert","\\vert"]),fn=new Set(["\\|","\\lVert","\\rVert","\\Vert"]),da=function(e,r,a,n,s,o){var c,m,d,v,b="",y=0;c=d=v=e,m=null;var x="Size1-Regular";e==="\\uparrow"?d=v="\u23D0":e==="\\Uparrow"?d=v="\u2016":e==="\\downarrow"?c=d="\u23D0":e==="\\Downarrow"?c=d="\u2016":e==="\\updownarrow"?(c="\\uparrow",d="\u23D0",v="\\downarrow"):e==="\\Updownarrow"?(c="\\Uparrow",d="\u2016",v="\\Downarrow"):pn.has(e)?(d="\u2223",b="vert",y=333):fn.has(e)?(d="\u2225",b="doublevert",y=556):e==="["||e==="\\lbrack"?(c="\u23A1",d="\u23A2",v="\u23A3",x="Size4-Regular",b="lbrack",y=667):e==="]"||e==="\\rbrack"?(c="\u23A4",d="\u23A5",v="\u23A6",x="Size4-Regular",b="rbrack",y=667):e==="\\lfloor"||e==="\u230A"?(d=c="\u23A2",v="\u23A3",x="Size4-Regular",b="lfloor",y=667):e==="\\lceil"||e==="\u2308"?(c="\u23A1",d=v="\u23A2",x="Size4-Regular",b="lceil",y=667):e==="\\rfloor"||e==="\u230B"?(d=c="\u23A5",v="\u23A6",x="Size4-Regular",b="rfloor",y=667):e==="\\rceil"||e==="\u2309"?(c="\u23A4",d=v="\u23A5",x="Size4-Regular",b="rceil",y=667):e==="("||e==="\\lparen"?(c="\u239B",d="\u239C",v="\u239D",x="Size4-Regular",b="lparen",y=875):e===")"||e==="\\rparen"?(c="\u239E",d="\u239F",v="\u23A0",x="Size4-Regular",b="rparen",y=875):e==="\\{"||e==="\\lbrace"?(c="\u23A7",m="\u23A8",v="\u23A9",d="\u23AA",x="Size4-Regular"):e==="\\}"||e==="\\rbrace"?(c="\u23AB",m="\u23AC",v="\u23AD",d="\u23AA",x="Size4-Regular"):e==="\\lgroup"||e==="\u27EE"?(c="\u23A7",v="\u23A9",d="\u23AA",x="Size4-Regular"):e==="\\rgroup"||e==="\u27EF"?(c="\u23AB",v="\u23AD",d="\u23AA",x="Size4-Regular"):e==="\\lmoustache"||e==="\u23B0"?(c="\u23A7",v="\u23AD",d="\u23AA",x="Size4-Regular"):(e==="\\rmoustache"||e==="\u23B1")&&(c="\u23AB",v="\u23A9",d="\u23AA",x="Size4-Regular");var T=de(c,x,s),q=T.height+T.depth,D=de(d,x,s),C=D.height+D.depth,O=de(v,x,s),I=O.height+O.depth,R=0,L=1;if(m!==null){var F=de(m,x,s);R=F.height+F.depth,L=2}var G=q+I+R,V=Math.max(0,Math.ceil((r-G)/(L*C))),X=G+V*L*C,K=n.fontMetrics().axisHeight;a&&(K*=n.sizeMultiplier);var p0=X/2-K,n0=[];if(b.length>0){var B0=X-q-I,k0=Math.round(X*1e3),x0=v1(b,Math.round(B0*1e3)),R0=new M0(b,x0),J0=M(y/1e3),Q0=M(k0/1e3),tt=new S0([R0],{width:J0,height:Q0,viewBox:"0 0 "+y+" "+k0}),F0=X0([],[tt],n);F0.height=k0/1e3,F0.style.width=J0,F0.style.height=Q0,n0.push({type:"elem",elem:F0})}else{if(n0.push(ut(v,x,s)),n0.push(Ne),m===null){var H0=X-q-I+2*Et;n0.push(ct(d,H0,n))}else{var ce=(X-q-I-R)/2+2*Et;n0.push(ct(d,ce,n)),n0.push(Ne),n0.push(ut(m,x,s)),n0.push(Ne),n0.push(ct(d,ce,n))}n0.push(Ne),n0.push(ut(c,x,s))}var w0=n.havingBaseStyle($.TEXT),ke=P({positionType:"bottom",positionData:p0,children:n0});return Xt(k(["delimsizing","mult"],[ke],w0),$.TEXT,n,o)},ht=80,mt=.08,dt=function(e,r,a,n,s){var o=p1(e,n,a),c=new M0(e,o),m=new S0([c],{width:"400em",height:M(r),viewBox:"0 0 400000 "+a,preserveAspectRatio:"xMinYMin slice"});return X0(["hide-tail"],[m],s)},vn=function(e,r){var a=r.havingBaseSizing(),n=ba("\\surd",e*a.sizeMultiplier,ga,a),s=a.sizeMultiplier,o=Math.max(0,r.minRuleThickness-r.fontMetrics().sqrtRuleThickness),c,m,d,v,b;return n.type==="small"?(v=1e3+1e3*o+ht,e<1?s=1:e<1.4&&(s=.7),m=(1+o+mt)/s,d=(1+o)/s,c=dt("sqrtMain",m,v,o,r),c.style.minWidth="0.853em",b=.833/s):n.type==="large"?(v=(1e3+ht)*pe[n.size],d=(pe[n.size]+o)/s,m=(pe[n.size]+o+mt)/s,c=dt("sqrtSize"+n.size,m,v,o,r),c.style.minWidth="1.02em",b=1/s):(m=e+o+mt,d=e+o,v=Math.floor(1e3*e+o)+ht,c=dt("sqrtTall",m,v,o,r),c.style.minWidth="0.742em",b=1.056),c.height=d,c.style.height=M(m),{span:c,advanceWidth:b,ruleWidth:(r.fontMetrics().sqrtRuleThickness+o)*s}},pa=new Set(["(","\\lparen",")","\\rparen","[","\\lbrack","]","\\rbrack","\\{","\\lbrace","\\}","\\rbrace","\\lfloor","\\rfloor","\u230A","\u230B","\\lceil","\\rceil","\u2308","\u2309","\\surd"]),gn=new Set(["\\uparrow","\\downarrow","\\updownarrow","\\Uparrow","\\Downarrow","\\Updownarrow","|","\\|","\\vert","\\Vert","\\lvert","\\rvert","\\lVert","\\rVert","\\lgroup","\\rgroup","\u27EE","\u27EF","\\lmoustache","\\rmoustache","\u23B0","\u23B1"]),fa=new Set(["<",">","\\langle","\\rangle","/","\\backslash","\\lt","\\gt"]),pe=[0,1.2,1.8,2.4,3],va=function(e,r,a,n,s){if(e==="<"||e==="\\lt"||e==="\u27E8"?e="\\langle":(e===">"||e==="\\gt"||e==="\u27E9")&&(e="\\rangle"),pa.has(e)||fa.has(e))return ma(e,r,!1,a,n,s);if(gn.has(e))return da(e,pe[r],!1,a,n,s);throw new z("Illegal delimiter: '"+e+"'")},bn=[{type:"small",style:$.SCRIPTSCRIPT},{type:"small",style:$.SCRIPT},{type:"small",style:$.TEXT},{type:"large",size:1},{type:"large",size:2},{type:"large",size:3},{type:"large",size:4}],yn=[{type:"small",style:$.SCRIPTSCRIPT},{type:"small",style:$.SCRIPT},{type:"small",style:$.TEXT},{type:"stack"}],ga=[{type:"small",style:$.SCRIPTSCRIPT},{type:"small",style:$.SCRIPT},{type:"small",style:$.TEXT},{type:"large",size:1},{type:"large",size:2},{type:"large",size:3},{type:"large",size:4},{type:"stack"}],xn=function(e){if(e.type==="small")return"Main-Regular";if(e.type==="large")return"Size"+e.size+"-Regular";if(e.type==="stack")return"Size4-Regular";var r=e.type;throw new Error("Add support for delim type '"+r+"' here.")},ba=function(e,r,a,n){for(var s=Math.min(2,3-n.style.size),o=s;o<a.length;o++){var c=a[o];if(c.type==="stack")break;var m=de(e,xn(c),"math"),d=m.height+m.depth;if(c.type==="small"){var v=n.havingBaseStyle(c.style);d*=v.sizeMultiplier}if(d>r)return c}return a[a.length-1]},Ot=function(e,r,a,n,s,o){e==="<"||e==="\\lt"||e==="\u27E8"?e="\\langle":(e===">"||e==="\\gt"||e==="\u27E9")&&(e="\\rangle");var c;fa.has(e)?c=bn:pa.has(e)?c=ga:c=yn;var m=ba(e,r,c,n);return m.type==="small"?mn(e,m.style,a,n,s,o):m.type==="large"?ma(e,m.size,a,n,s,o):da(e,r,a,n,s,o)},pt=function(e,r,a,n,s,o){var c=n.fontMetrics().axisHeight*n.sizeMultiplier,m=901,d=5/n.fontMetrics().ptPerEm,v=Math.max(r-c,a+c),b=Math.max(v/500*m,2*v-d);return Ot(e,b,!0,n,s,o)},Ar={"\\bigl":{mclass:"mopen",size:1},"\\Bigl":{mclass:"mopen",size:2},"\\biggl":{mclass:"mopen",size:3},"\\Biggl":{mclass:"mopen",size:4},"\\bigr":{mclass:"mclose",size:1},"\\Bigr":{mclass:"mclose",size:2},"\\biggr":{mclass:"mclose",size:3},"\\Biggr":{mclass:"mclose",size:4},"\\bigm":{mclass:"mrel",size:1},"\\Bigm":{mclass:"mrel",size:2},"\\biggm":{mclass:"mrel",size:3},"\\Biggm":{mclass:"mrel",size:4},"\\big":{mclass:"mord",size:1},"\\Big":{mclass:"mord",size:2},"\\bigg":{mclass:"mord",size:3},"\\Bigg":{mclass:"mord",size:4}},wn=new Set(["(","\\lparen",")","\\rparen","[","\\lbrack","]","\\rbrack","\\{","\\lbrace","\\}","\\rbrace","\\lfloor","\\rfloor","\u230A","\u230B","\\lceil","\\rceil","\u2308","\u2309","<",">","\\langle","\u27E8","\\rangle","\u27E9","\\lt","\\gt","\\lvert","\\rvert","\\lVert","\\rVert","\\lgroup","\\rgroup","\u27EE","\u27EF","\\lmoustache","\\rmoustache","\u23B0","\u23B1","/","\\backslash","|","\\vert","\\|","\\Vert","\\uparrow","\\Uparrow","\\downarrow","\\Downarrow","\\updownarrow","\\Updownarrow","."]);function Tr(t){return"isMiddle"in t}function Qe(t,e){var r=Ke(t);if(r&&wn.has(r.text))return r;throw r?new z("Invalid delimiter '"+r.text+"' after '"+e.funcName+"'",t):new z("Invalid delimiter type '"+t.type+"'",t)}B({type:"delimsizing",names:["\\bigl","\\Bigl","\\biggl","\\Biggl","\\bigr","\\Bigr","\\biggr","\\Biggr","\\bigm","\\Bigm","\\biggm","\\Biggm","\\big","\\Big","\\bigg","\\Bigg"],numArgs:1,argTypes:["primitive"],handler:(t,e)=>{var r=Qe(xe(e[0]),t);return{type:"delimsizing",mode:t.parser.mode,size:Ar[t.funcName].size,mclass:Ar[t.funcName].mclass,delim:r.text}},htmlBuilder:(t,e)=>t.delim==="."?k([t.mclass]):va(t.delim,t.size,e,t.mode,[t.mclass]),mathmlBuilder:t=>{var e=[];t.delim!=="."&&e.push(y0(t.delim,t.mode));var r=new A("mo",e);t.mclass==="mopen"||t.mclass==="mclose"?r.setAttribute("fence","true"):r.setAttribute("fence","false"),r.setAttribute("stretchy","true");var a=M(pe[t.size]);return r.setAttribute("minsize",a),r.setAttribute("maxsize",a),r}});function Mr(t){if(!t.body)throw new Error("Bug: The leftright ParseNode wasn't fully parsed.")}B({type:"leftright-right",names:["\\right"],numArgs:1,primitive:!0,handler:(t,e)=>{var r=t.parser.gullet.macros.get("\\current@color");if(r&&typeof r!="string")throw new z("\\current@color set to non-string in \\right");return{type:"leftright-right",mode:t.parser.mode,delim:Qe(e[0],t).text,color:r}}});B({type:"leftright",names:["\\left"],numArgs:1,primitive:!0,handler:(t,e)=>{var r=Qe(e[0],t),a=t.parser;++a.leftrightDepth;var n=a.parseExpression(!1);--a.leftrightDepth,a.expect("\\right",!1);var s=H(a.parseFunction(),"leftright-right");return{type:"leftright",mode:a.mode,body:n,left:r.text,right:s.delim,rightColor:s.color}},htmlBuilder:(t,e)=>{Mr(t);for(var r=s0(t.body,e,!0,["mopen","mclose"]),a=0,n=0,s=!1,o=0;o<r.length;o++){var c=r[o];Tr(c)?s=!0:(a=Math.max(r[o].height,a),n=Math.max(r[o].depth,n))}a*=e.sizeMultiplier,n*=e.sizeMultiplier;var m;if(t.left==="."?m=we(e,["mopen"]):m=pt(t.left,a,n,e,t.mode,["mopen"]),r.unshift(m),s)for(var d=1;d<r.length;d++){var v=r[d];if(Tr(v)){var b=v.isMiddle;r[d]=pt(b.delim,a,n,b.options,t.mode,[])}}var y;if(t.right===".")y=we(e,["mclose"]);else{var x=t.rightColor?e.withColor(t.rightColor):e;y=pt(t.right,a,n,x,t.mode,["mclose"])}return r.push(y),k(["minner"],r,e)},mathmlBuilder:(t,e)=>{Mr(t);var r=g0(t.body,e);if(t.left!=="."){var a=new A("mo",[y0(t.left,t.mode)]);a.setAttribute("fence","true"),r.unshift(a)}if(t.right!=="."){var n=new A("mo",[y0(t.right,t.mode)]);n.setAttribute("fence","true"),t.rightColor&&n.setAttribute("mathcolor",t.rightColor),r.push(n)}return Pt(r)}});B({type:"middle",names:["\\middle"],numArgs:1,primitive:!0,handler:(t,e)=>{var r=Qe(e[0],t);if(!t.parser.leftrightDepth)throw new z("\\middle without preceding \\left",r);return{type:"middle",mode:t.parser.mode,delim:r.text}},htmlBuilder:(t,e)=>{var r;return t.delim==="."?r=we(e,[]):(r=va(t.delim,1,e,t.mode,[]),r.isMiddle={delim:t.delim,options:e}),r},mathmlBuilder:(t,e)=>{var r=t.delim==="\\vert"||t.delim==="|"?y0("|","text"):y0(t.delim,t.mode),a=new A("mo",[r]);return a.setAttribute("fence","true"),a.setAttribute("lspace","0.05em"),a.setAttribute("rspace","0.05em"),a}});var Sn=(t,e)=>{var r=le(U(t.body,e),e),a=t.label.slice(1),n=e.sizeMultiplier,s,o,c=I0(t.body);if(a==="sout")s=k(["katex-stretchy","katex-sout"]),s.height=e.fontMetrics().defaultRuleThickness/n,o=-.5*e.fontMetrics().xHeight;else if(a==="phase"){var m=e0({number:.6,unit:"pt"},e),d=e0({number:.35,unit:"ex"},e),v=e.havingBaseSizing();n=n/v.sizeMultiplier;var b=r.height+r.depth+m+d;r.style.paddingLeft=M(b/2+m);var y=Math.floor(1e3*b*n),x=m1(y),T=new S0([new M0("phase",x)],{width:"400em",height:M(y/1e3),viewBox:"0 0 400000 "+y,preserveAspectRatio:"xMinYMin slice"});s=X0(["hide-tail"],[T],e),s.style.height=M(b),o=r.depth+m+d}else{/cancel/.test(a)?c||r.classes.push("cancel-pad"):a==="angl"?r.classes.push("anglpad"):r.classes.push("boxpad");var q,D,C=0;/box/.test(a)?(C=Math.max(e.fontMetrics().fboxrule,e.minRuleThickness),q=e.fontMetrics().fboxsep+(a==="colorbox"?0:C),D=q):a==="angl"?(C=Math.max(e.fontMetrics().defaultRuleThickness,e.minRuleThickness),q=4*C,D=Math.max(0,.25-r.depth)):(q=c?.2:0,D=q),s=j1(r,a,q,D,e),/fbox|boxed|fcolorbox/.test(a)?(s.style.borderStyle="solid",s.style.borderWidth=M(C)):a==="angl"&&C!==.049&&(s.style.borderTopWidth=M(C),s.style.borderRightWidth=M(C)),o=r.depth+D,t.backgroundColor&&(s.style.backgroundColor=t.backgroundColor,t.borderColor&&(s.style.borderColor=t.borderColor))}var O;if(t.backgroundColor)O=P({positionType:"individualShift",children:[{type:"elem",elem:s,shift:o},{type:"elem",elem:r,shift:0}]});else{var I=/cancel|phase/.test(a)?["svg-align"]:[];O=P({positionType:"individualShift",children:[{type:"elem",elem:r,shift:0},{type:"elem",elem:s,shift:o,wrapperClasses:I}]})}return/cancel/.test(a)&&(O.height=r.height,O.depth=r.depth),/cancel/.test(a)&&!c?k(["mord","cancel-lap"],[O],e):k(["mord"],[O],e)},kn=(t,e)=>{var r,a=new A(t.label.includes("colorbox")?"mpadded":"menclose",[W(t.body,e)]);switch(t.label){case"\\cancel":a.setAttribute("notation","updiagonalstrike");break;case"\\bcancel":a.setAttribute("notation","downdiagonalstrike");break;case"\\phase":a.setAttribute("notation","phasorangle");break;case"\\sout":a.setAttribute("notation","horizontalstrike");break;case"\\fbox":a.setAttribute("notation","box");break;case"\\angl":a.setAttribute("notation","actuarial");break;case"\\fcolorbox":case"\\colorbox":if(r=e.fontMetrics().fboxsep*e.fontMetrics().ptPerEm,a.setAttribute("width","+"+2*r+"pt"),a.setAttribute("height","+"+2*r+"pt"),a.setAttribute("lspace",r+"pt"),a.setAttribute("voffset",r+"pt"),t.label==="\\fcolorbox"){var n=Math.max(e.fontMetrics().fboxrule,e.minRuleThickness);a.setAttribute("style","border: "+M(n)+" solid "+t.borderColor)}break;case"\\xcancel":a.setAttribute("notation","updiagonalstrike downdiagonalstrike");break}return t.backgroundColor&&a.setAttribute("mathbackground",t.backgroundColor),a};B({type:"enclose",names:["\\colorbox"],numArgs:2,allowedInText:!0,argTypes:["color","hbox"],handler(t,e,r){var a=t.parser,n=t.funcName,s=H(e[0],"color-token").color,o=e[1];return{type:"enclose",mode:a.mode,label:n,backgroundColor:s,body:o}},htmlBuilder:Sn,mathmlBuilder:kn});B({type:"enclose",names:["\\fcolorbox"],numArgs:3,allowedInText:!0,argTypes:["color","color","hbox"],handler(t,e,r){var a=t.parser,n=t.funcName,s=H(e[0],"color-token").color,o=H(e[1],"color-token").color,c=e[2];return{type:"enclose",mode:a.mode,label:n,backgroundColor:o,borderColor:s,body:c}}});B({type:"enclose",names:["\\fbox"],numArgs:1,argTypes:["hbox"],allowedInText:!0,handler(t,e){var r=t.parser;return{type:"enclose",mode:r.mode,label:"\\fbox",body:e[0]}}});B({type:"enclose",names:["\\cancel","\\bcancel","\\xcancel","\\phase"],numArgs:1,handler(t,e){var r=t.parser,a=t.funcName,n=e[0];return{type:"enclose",mode:r.mode,label:a,body:n}}});B({type:"enclose",names:["\\sout"],numArgs:1,allowedInText:!0,handler(t,e){var r=t.parser,a=t.funcName;r.mode==="math"&&r.settings.reportNonstrict("mathVsSout","LaTeX's \\sout works only in text mode");var n=e[0];return{type:"enclose",mode:r.mode,label:a,body:n}}});B({type:"enclose",names:["\\angl"],numArgs:1,argTypes:["hbox"],allowedInText:!1,handler(t,e){var r=t.parser;return{type:"enclose",mode:r.mode,label:"\\angl",body:e[0]}}});var ya={};function q0(t){for(var e=t.type,r=t.names,a=t.props,n=t.handler,s=t.htmlBuilder,o=t.mathmlBuilder,c={type:e,numArgs:a.numArgs||0,allowedInText:!1,numOptionalArgs:0,handler:n},m=0;m<r.length;++m)ya[r[m]]=c;s&&(be[e]=s),o&&(ye[e]=o)}var xa={};function h(t,e){xa[t]=e}var d0=class t{constructor(e,r,a){this.lexer=void 0,this.start=void 0,this.end=void 0,this.lexer=e,this.start=r,this.end=a}static range(e,r){return r?!e||!e.loc||!r.loc||e.loc.lexer!==r.loc.lexer?null:new t(e.loc.lexer,e.loc.start,r.loc.end):e&&e.loc}},f0=class t{constructor(e,r){this.text=void 0,this.loc=void 0,this.noexpand=void 0,this.treatAsRelax=void 0,this.text=e,this.loc=r}range(e,r){return new t(r,d0.range(this,e))}};function qr(t){var e=[];t.consumeSpaces();var r=t.fetch().text;for(r==="\\relax"&&(t.consume(),t.consumeSpaces(),r=t.fetch().text);r==="\\hline"||r==="\\hdashline";)t.consume(),e.push(r==="\\hdashline"),t.consumeSpaces(),r=t.fetch().text;return e}var et=t=>{var e=t.parser.settings;if(!e.displayMode)throw new z("{"+t.envName+"} can be used only in display mode.")},zn=new Set(["gather","gather*"]);function Wt(t){if(!t.includes("ed"))return!t.includes("*")}function j0(t,e,r){var a=e.hskipBeforeAndAfter,n=e.addJot,s=e.cols,o=e.arraystretch,c=e.colSeparationType,m=e.autoTag,d=e.singleRow,v=e.emptySingleRow,b=e.maxNumCols,y=e.leqno;if(t.gullet.beginGroup(),d||t.gullet.macros.set("\\cr","\\\\\\relax"),!o){var x=t.gullet.expandMacroAsText("\\arraystretch");if(x==null)o=1;else if(o=parseFloat(x),!o||o<0)throw new z("Invalid \\arraystretch: "+x)}t.gullet.beginGroup();var T=[],q=[T],D=[],C=[],O=m!=null?[]:void 0;function I(){m&&t.gullet.macros.set("\\@eqnsw","1",!0)}function R(){O&&(t.gullet.macros.get("\\df@tag")?(O.push(t.subparse([new f0("\\df@tag")])),t.gullet.macros.set("\\df@tag",void 0,!0)):O.push(!!m&&t.gullet.macros.get("\\@eqnsw")==="1"))}for(I(),C.push(qr(t));;){var L=t.parseExpression(!1,d?"\\end":"\\\\");t.gullet.endGroup(),t.gullet.beginGroup();var F={type:"ordgroup",mode:t.mode,body:L};r&&(F={type:"styling",mode:t.mode,style:r,resetFont:!0,body:[F]}),T.push(F);var G=t.fetch().text;if(G==="&"){if(b&&T.length===b){if(d||c)throw new z("Too many tab characters: &",t.nextToken);t.settings.reportNonstrict("textEnv","Too few columns specified in the {array} column argument.")}t.consume()}else if(G==="\\end"){R(),T.length===1&&F.type==="styling"&&F.body.length===1&&F.body[0].type==="ordgroup"&&F.body[0].body.length===0&&(q.length>1||!v)&&q.pop(),C.length<q.length+1&&C.push([]);break}else if(G==="\\\\"){t.consume();var V=void 0;t.gullet.future().text!==" "&&(V=t.parseSizeGroup(!0)),D.push(V?V.value:null),R(),C.push(qr(t)),T=[],q.push(T),I()}else throw new z("Expected & or \\\\ or \\cr or \\end",t.nextToken)}return t.gullet.endGroup(),t.gullet.endGroup(),{type:"array",mode:t.mode,addJot:n,arraystretch:o,body:q,cols:s,rowGaps:D,hskipBeforeAndAfter:a,hLinesBeforeRow:C,colSeparationType:c,tags:O,leqno:y}}function jt(t){return t.slice(0,1)==="d"?"display":"text"}var D0=function(e,r){var a,n,s=e.body.length,o=e.hLinesBeforeRow,c=0,m=new Array(s),d=[],v=Math.max(r.fontMetrics().arrayRuleWidth,r.minRuleThickness),b=1/r.fontMetrics().ptPerEm,y=5*b;if(e.colSeparationType&&e.colSeparationType==="small"){var x=r.havingStyle($.SCRIPT).sizeMultiplier;y=.2778*(x/r.sizeMultiplier)}var T=e.colSeparationType==="CD"?e0({number:3,unit:"ex"},r):12*b,q=3*b,D=e.arraystretch*T,C=.7*D,O=.3*D,I=0;function R(Me){for(var qe=0;qe<Me.length;++qe)qe>0&&(I+=.25),d.push({pos:I,isDashed:Me[qe]})}for(R(o[0]),a=0;a<e.body.length;++a){var L=e.body[a],F=C,G=O;c<L.length&&(c=L.length);var V={cells:new Array(L.length),height:0,depth:0,pos:0};for(n=0;n<L.length;++n){var X=U(L[n],r);G<X.depth&&(G=X.depth),F<X.height&&(F=X.height),V.cells[n]=X}var K=e.rowGaps[a],p0=0;K&&(p0=e0(K,r),p0>0&&(p0+=O,G<p0&&(G=p0),p0=0)),e.addJot&&a<e.body.length-1&&(G+=q),V.height=F,V.depth=G,I+=F,V.pos=I,I+=G+p0,m[a]=V,R(o[a+1])}var n0=I/2+r.fontMetrics().axisHeight,B0=e.cols||[],k0=[],x0,R0,J0=[];if(e.tags&&e.tags.some(Me=>Me))for(a=0;a<s;++a){var Q0=m[a],tt=Q0.pos-n0,F0=e.tags[a],H0=void 0;F0===!0?H0=k(["eqn-num"],[],r):F0===!1?H0=k([],[],r):H0=k([],s0(F0,r,!0),r),H0.depth=Q0.depth,H0.height=Q0.height,J0.push({type:"elem",elem:H0,shift:tt})}for(n=0,R0=0;n<c||R0<B0.length;++n,++R0){for(var ce,w0=B0[R0],ke=!0;((Qt=w0)==null?void 0:Qt.type)==="separator";){var Qt;if(ke||(x0=k(["arraycolsep"],[]),x0.style.width=M(r.fontMetrics().doubleRuleSep),k0.push(x0)),w0.separator==="|"||w0.separator===":"){var $a=w0.separator==="|"?"solid":"dashed",ee=k(["vertical-separator"],[],r);ee.style.height=M(I),ee.style.borderRightWidth=M(v),ee.style.borderRightStyle=$a,ee.style.margin="0 "+M(-v/2);var er=I-n0;er&&(ee.style.verticalAlign=M(-er)),k0.push(ee)}else throw new z("Invalid separator type: "+w0.separator);R0++,w0=B0[R0],ke=!1}if(!(n>=c)){var te=void 0;if(n>0||e.hskipBeforeAndAfter){var tr,rr;te=(tr=(rr=w0)==null?void 0:rr.pregap)!=null?tr:y,te!==0&&(x0=k(["arraycolsep"],[]),x0.style.width=M(te),k0.push(x0))}var ar=[];for(a=0;a<s;++a){var ze=m[a],Ae=ze.cells[n];if(Ae){var Ra=ze.pos-n0;Ae.depth=ze.depth,Ae.height=ze.height,ar.push({type:"elem",elem:Ae,shift:Ra})}}var Fa=P({positionType:"individualShift",children:ar}),Ha=k(["col-align-"+(((ce=w0)==null?void 0:ce.align)||"c")],[Fa]);if(k0.push(Ha),n<c-1||e.hskipBeforeAndAfter){var nr,ir;te=(nr=(ir=w0)==null?void 0:ir.postgap)!=null?nr:y,te!==0&&(x0=k(["arraycolsep"],[]),x0.style.width=M(te),k0.push(x0))}}}var Te=k(["mtable"],k0);if(d.length>0){for(var La=se("katex-hline",r,v),Ga=se("katex-hdashline",r,v),rt=[{type:"elem",elem:Te,shift:0}];d.length>0;){var sr=d.pop(),lr=sr.pos-n0;sr.isDashed?rt.push({type:"elem",elem:Ga,shift:lr}):rt.push({type:"elem",elem:La,shift:lr})}Te=P({positionType:"individualShift",children:rt})}if(J0.length===0)return k(["mord"],[Te],r);var Pa=P({positionType:"individualShift",children:J0}),Ua=k(["katex-tag"],[Pa],r);return $0([Te,Ua])},An={c:"center ",l:"left ",r:"right "},C0=function(e,r){for(var a=[],n=new A("mtd",[],["mtr-glue"]),s=new A("mtd",[],["mml-eqn-num"]),o=0;o<e.body.length;o++){for(var c=e.body[o],m=[],d=0;d<c.length;d++)m.push(new A("mtd",[W(c[d],r)]));e.tags&&e.tags[o]&&(m.unshift(n),m.push(n),e.leqno?m.unshift(s):m.push(s)),a.push(new A("mtr",m))}var v=new A("mtable",a),b=e.arraystretch===.5?.1:.16+e.arraystretch-1+(e.addJot?.09:0);v.setAttribute("rowspacing",M(b));var y="",x="";if(e.cols&&e.cols.length>0){var T=e.cols,q="",D=!1,C=0,O=T.length;T[0].type==="separator"&&(y+="top ",C=1),T[T.length-1].type==="separator"&&(y+="bottom ",O-=1);for(var I=C;I<O;I++){var R=T[I];R.type==="align"?(x+=An[R.align],D&&(q+="none "),D=!0):R.type==="separator"&&D&&(q+=R.separator==="|"?"solid ":"dashed ",D=!1)}v.setAttribute("columnalign",x.trim()),/[sd]/.test(q)&&v.setAttribute("columnlines",q.trim())}if(e.colSeparationType==="align"){for(var L=e.cols||[],F="",G=1;G<L.length;G++)F+=G%2?"0em ":"1em ";v.setAttribute("columnspacing",F.trim())}else e.colSeparationType==="alignat"||e.colSeparationType==="gather"?v.setAttribute("columnspacing","0em"):e.colSeparationType==="small"?v.setAttribute("columnspacing","0.2778em"):e.colSeparationType==="CD"?v.setAttribute("columnspacing","0.5em"):v.setAttribute("columnspacing","1em");var V="",X=e.hLinesBeforeRow;y+=X[0].length>0?"left ":"",y+=X[X.length-1].length>0?"right ":"";for(var K=1;K<X.length-1;K++)V+=X[K].length===0?"none ":X[K][0]?"dashed ":"solid ";return/[sd]/.test(V)&&v.setAttribute("rowlines",V.trim()),y!==""&&(v=new A("menclose",[v]),v.setAttribute("notation",y.trim())),e.arraystretch&&e.arraystretch<1&&(v=new A("mstyle",[v]),v.setAttribute("scriptlevel","1")),v},wa=function(e,r){e.envName.includes("ed")||et(e);var a=[],n=e.envName==="split",s=j0(e.parser,{cols:a,addJot:!0,autoTag:n?void 0:Wt(e.envName),emptySingleRow:!0,colSeparationType:e.envName.includes("at")?"alignat":"align",maxNumCols:n?2:void 0,leqno:e.parser.settings.leqno},"display"),o=0,c=0,m={type:"ordgroup",mode:e.mode,body:[]};if(r[0]&&r[0].type==="ordgroup"){var d="Number of columns should be a positive integer",v=Vt(r[0],d);if(!/^[0-9]+$/.test(v)||Number(v)<1)throw new z(d,r[0]);o=Number(v),c=o*2}var b=!c;s.body.forEach(function(q){for(var D=1;D<q.length;D+=2){var C=H(q[D],"styling"),O=H(C.body[0],"ordgroup");O.body.unshift(m)}if(b)c<q.length&&(c=q.length);else{var I=q.length/2;if(o<I)throw new z("Too many math in a row: "+("expected "+o+", but got "+I),q[0])}});for(var y=0;y<c;++y){var x="r",T=0;y%2===1?x="l":y>0&&b&&(T=1),a[y]={type:"align",align:x,pregap:T,postgap:0}}return s.colSeparationType=b?"align":"alignat",s};q0({type:"array",names:["array","darray"],props:{numArgs:1},handler(t,e){var r=Ke(e[0]),a=r?[e[0]]:H(e[0],"ordgroup").body,n=a.map(function(o){var c=Ze(o),m=c.text;if("lcr".includes(m))return{type:"align",align:m};if(m==="|")return{type:"separator",separator:"|"};if(m===":")return{type:"separator",separator:":"};throw new z("Unknown column alignment: "+m,o)}),s={cols:n,hskipBeforeAndAfter:!0,maxNumCols:n.length};return j0(t.parser,s,jt(t.envName))},htmlBuilder:D0,mathmlBuilder:C0});q0({type:"array",names:["matrix","pmatrix","bmatrix","Bmatrix","vmatrix","Vmatrix","matrix*","pmatrix*","bmatrix*","Bmatrix*","vmatrix*","Vmatrix*"],props:{numArgs:0},handler(t){var e={matrix:null,pmatrix:["(",")"],bmatrix:["[","]"],Bmatrix:["\\{","\\}"],vmatrix:["|","|"],Vmatrix:["\\Vert","\\Vert"]}[t.envName.replace("*","")],r="c",a={hskipBeforeAndAfter:!1,cols:[{type:"align",align:r}]};if(t.envName.charAt(t.envName.length-1)==="*"){var n=t.parser;if(n.consumeSpaces(),n.fetch().text==="["){if(n.consume(),n.consumeSpaces(),r=n.fetch().text,!"lcr".includes(r))throw new z("Expected l or c or r",n.nextToken);n.consume(),n.consumeSpaces(),n.expect("]"),n.consume(),a.cols=[{type:"align",align:r}]}}var s=j0(t.parser,a,jt(t.envName)),o=Math.max(0,...s.body.map(c=>c.length));return s.cols=new Array(o).fill({type:"align",align:r}),e?{type:"leftright",mode:t.mode,body:[s],left:e[0],right:e[1],rightColor:void 0}:s},htmlBuilder:D0,mathmlBuilder:C0});q0({type:"array",names:["smallmatrix"],props:{numArgs:0},handler(t){var e={arraystretch:.5},r=j0(t.parser,e,"script");return r.colSeparationType="small",r},htmlBuilder:D0,mathmlBuilder:C0});q0({type:"array",names:["subarray"],props:{numArgs:1},handler(t,e){var r=Ke(e[0]),a=r?[e[0]]:H(e[0],"ordgroup").body,n=a.map(function(c){var m=Ze(c),d=m.text;if("lc".includes(d))return{type:"align",align:d};throw new z("Unknown column alignment: "+d,c)});if(n.length>1)throw new z("{subarray} can contain only one column");var s={cols:n,hskipBeforeAndAfter:!1,arraystretch:.5},o=j0(t.parser,s,"script");if(o.body.length>0&&o.body[0].length>1)throw new z("{subarray} can contain only one column");return o},htmlBuilder:D0,mathmlBuilder:C0});q0({type:"array",names:["cases","dcases","rcases","drcases"],props:{numArgs:0},handler(t){var e={arraystretch:1.2,cols:[{type:"align",align:"l",pregap:0,postgap:1},{type:"align",align:"l",pregap:0,postgap:0}]},r=j0(t.parser,e,jt(t.envName));return{type:"leftright",mode:t.mode,body:[r],left:t.envName.includes("r")?".":"\\{",right:t.envName.includes("r")?"\\}":".",rightColor:void 0}},htmlBuilder:D0,mathmlBuilder:C0});q0({type:"array",names:["align","align*","aligned","split"],props:{numArgs:0},handler:wa,htmlBuilder:D0,mathmlBuilder:C0});q0({type:"array",names:["gathered","gather","gather*"],props:{numArgs:0},handler(t){zn.has(t.envName)&&et(t);var e={cols:[{type:"align",align:"c"}],addJot:!0,colSeparationType:"gather",autoTag:Wt(t.envName),emptySingleRow:!0,leqno:t.parser.settings.leqno};return j0(t.parser,e,"display")},htmlBuilder:D0,mathmlBuilder:C0});q0({type:"array",names:["alignat","alignat*","alignedat"],props:{numArgs:1},handler:wa,htmlBuilder:D0,mathmlBuilder:C0});q0({type:"array",names:["equation","equation*"],props:{numArgs:0},handler(t){et(t);var e={autoTag:Wt(t.envName),emptySingleRow:!0,singleRow:!0,maxNumCols:1,leqno:t.parser.settings.leqno};return j0(t.parser,e,"display")},htmlBuilder:D0,mathmlBuilder:C0});q0({type:"array",names:["CD"],props:{numArgs:0},handler(t){return et(t),on(t.parser)},htmlBuilder:D0,mathmlBuilder:C0});h("\\nonumber","\\gdef\\@eqnsw{0}");h("\\notag","\\nonumber");B({type:"text",names:["\\hline","\\hdashline"],numArgs:0,allowedInText:!0,allowedInMath:!0,handler(t,e){throw new z(t.funcName+" valid only within array environment")}});var Dr=ya;B({type:"environment",names:["\\begin","\\end"],numArgs:1,argTypes:["text"],handler(t,e){var r=t.parser,a=t.funcName,n=e[0];if(n.type!=="ordgroup")throw new z("Invalid environment name",n);var s=Vt(n,"Environment name should contain only text characters and spaces",!0);if(a==="\\begin"){if(!Object.prototype.hasOwnProperty.call(Dr,s))throw new z("No such environment: "+s,n);var o=Dr[s],c=r.parseArguments("\\begin{"+s+"}",o),m=c.args,d=c.optArgs,v={mode:r.mode,envName:s,parser:r},b=o.handler(v,m,d);r.expect("\\end",!1);var y=r.nextToken,x=H(r.parseFunction(),"environment");if(x.name!==s)throw new z("Mismatch: \\begin{"+s+"} matched by \\end{"+x.name+"}",y);return b}return{type:"environment",mode:r.mode,name:s,nameGroup:n}}});var Tn=(t,e)=>{var r=t.font,a=e.withFont(r);return U(t.body,a)},Mn=(t,e)=>{var r=t.font,a=e.withFont(r);return W(t.body,a)},Cr={"\\Bbb":"\\mathbb","\\bold":"\\mathbf","\\frak":"\\mathfrak"};B({type:"font",names:["\\mathrm","\\mathit","\\mathbf","\\mathnormal","\\mathsfit","\\mathbb","\\mathcal","\\mathfrak","\\mathscr","\\mathsf","\\mathtt","\\Bbb","\\bold","\\frak"],numArgs:1,allowedInArgument:!0,handler:(t,e)=>{var r=t.parser,a=t.funcName,n=xe(e[0]),s=a in Cr?Cr[a]:a;return{type:"font",mode:r.mode,font:s.slice(1),body:n}},htmlBuilder:Tn,mathmlBuilder:Mn});B({type:"mclass",names:["\\boldsymbol","\\bm"],numArgs:1,handler:(t,e)=>{var r=t.parser,a=e[0];return{type:"mclass",mode:r.mode,mclass:Je(a),body:[{type:"font",mode:r.mode,font:"boldsymbol",body:a}],isCharacterBox:I0(a)}}});B({type:"font",names:["\\rm","\\sf","\\tt","\\bf","\\it","\\cal"],numArgs:0,allowedInText:!0,handler:(t,e)=>{var r=t.parser,a=t.funcName,n=t.breakOnTokenText,s=r.mode,o=r.parseExpression(!0,n);return{type:"font",mode:s,font:"math"+a.slice(1),body:{type:"ordgroup",mode:r.mode,body:o}}}});var qn=(t,e)=>{var r=e.style,a=r.fracNum(),n=r.fracDen(),s;s=e.havingStyle(a);var o=U(t.numer,s,e);if(t.continued){var c=8.5/e.fontMetrics().ptPerEm,m=3.5/e.fontMetrics().ptPerEm;o.height=o.height<c?c:o.height,o.depth=o.depth<m?m:o.depth}s=e.havingStyle(n);var d=U(t.denom,s,e),v,b,y;t.hasBarLine?(t.barSize?(b=e0(t.barSize,e),v=se("frac-line",e,b)):v=se("frac-line",e),b=v.height,y=v.height):(v=null,b=0,y=e.fontMetrics().defaultRuleThickness);var x,T,q;r.size===$.DISPLAY.size?(x=e.fontMetrics().num1,b>0?T=3*y:T=7*y,q=e.fontMetrics().denom1):(b>0?(x=e.fontMetrics().num2,T=y):(x=e.fontMetrics().num3,T=3*y),q=e.fontMetrics().denom2);var D;if(v){var O=e.fontMetrics().axisHeight;x-o.depth-(O+.5*b)<T&&(x+=T-(x-o.depth-(O+.5*b))),O-.5*b-(d.height-q)<T&&(q+=T-(O-.5*b-(d.height-q)));var I=-(O-.5*b);D=P({positionType:"individualShift",children:[{type:"elem",elem:d,shift:q},{type:"elem",elem:v,shift:I},{type:"elem",elem:o,shift:-x}]})}else{var C=x-o.depth-(d.height-q);C<T&&(x+=.5*(T-C),q+=.5*(T-C)),D=P({positionType:"individualShift",children:[{type:"elem",elem:d,shift:q},{type:"elem",elem:o,shift:-x}]})}s=e.havingStyle(r),D.height*=s.sizeMultiplier/e.sizeMultiplier,D.depth*=s.sizeMultiplier/e.sizeMultiplier;var R;r.size===$.DISPLAY.size?R=e.fontMetrics().delim1:r.size===$.SCRIPTSCRIPT.size?R=e.havingStyle($.SCRIPT).fontMetrics().delim2:R=e.fontMetrics().delim2;var L,F;return t.leftDelim==null?L=we(e,["mopen"]):L=Ot(t.leftDelim,R,!0,e.havingStyle(r),t.mode,["mopen"]),t.continued?F=k([]):t.rightDelim==null?F=we(e,["mclose"]):F=Ot(t.rightDelim,R,!0,e.havingStyle(r),t.mode,["mclose"]),k(["mord"].concat(s.sizingClasses(e)),[L,k(["mfrac"],[D]),F],e)},Dn=(t,e)=>{var r=new A("mfrac",[W(t.numer,e),W(t.denom,e)]);if(!t.hasBarLine)r.setAttribute("linethickness","0px");else if(t.barSize){var a=e0(t.barSize,e);r.setAttribute("linethickness",M(a))}if(t.leftDelim!=null||t.rightDelim!=null){var n=[];if(t.leftDelim!=null){var s=new A("mo",[new t0(t.leftDelim.replace("\\",""))]);s.setAttribute("fence","true"),n.push(s)}if(n.push(r),t.rightDelim!=null){var o=new A("mo",[new t0(t.rightDelim.replace("\\",""))]);o.setAttribute("fence","true"),n.push(o)}return Pt(n)}return r},Sa=(t,e)=>{if(!e)return t;var r={type:"styling",mode:t.mode,style:e,body:[t]};return r};B({type:"genfrac",names:["\\cfrac","\\dfrac","\\frac","\\tfrac","\\dbinom","\\binom","\\tbinom","\\\\atopfrac","\\\\bracefrac","\\\\brackfrac"],numArgs:2,allowedInArgument:!0,handler:(t,e)=>{var r=t.parser,a=t.funcName,n=e[0],s=e[1],o,c=null,m=null;switch(a){case"\\cfrac":case"\\dfrac":case"\\frac":case"\\tfrac":o=!0;break;case"\\\\atopfrac":o=!1;break;case"\\dbinom":case"\\binom":case"\\tbinom":o=!1,c="(",m=")";break;case"\\\\bracefrac":o=!1,c="\\{",m="\\}";break;case"\\\\brackfrac":o=!1,c="[",m="]";break;default:throw new Error("Unrecognized genfrac command")}var d=a==="\\cfrac",v=null;return d||a.startsWith("\\d")?v="display":a.startsWith("\\t")&&(v="text"),Sa({type:"genfrac",mode:r.mode,numer:n,denom:s,continued:d,hasBarLine:o,leftDelim:c,rightDelim:m,barSize:null},v)},htmlBuilder:qn,mathmlBuilder:Dn});B({type:"infix",names:["\\over","\\choose","\\atop","\\brace","\\brack"],numArgs:0,infix:!0,handler(t){var e=t.parser,r=t.funcName,a=t.token,n;switch(r){case"\\over":n="\\frac";break;case"\\choose":n="\\binom";break;case"\\atop":n="\\\\atopfrac";break;case"\\brace":n="\\\\bracefrac";break;case"\\brack":n="\\\\brackfrac";break;default:throw new Error("Unrecognized infix genfrac command")}return{type:"infix",mode:e.mode,replaceWith:n,token:a}}});var Br=["display","text","script","scriptscript"],Er=function(e){var r=null;return e.length>0&&(r=e,r=r==="."?null:r),r};B({type:"genfrac",names:["\\genfrac"],numArgs:6,allowedInArgument:!0,argTypes:["math","math","size","text","math","math"],handler(t,e){var r=t.parser,a=e[4],n=e[5],s=xe(e[0]),o=s.type==="atom"&&s.family==="open"?Er(s.text):null,c=xe(e[1]),m=c.type==="atom"&&c.family==="close"?Er(c.text):null,d=H(e[2],"size"),v,b=null;d.isBlank?v=!0:(b=d.value,v=b.number>0);var y=null,x=e[3];if(x.type==="ordgroup"){if(x.body.length>0){var T=H(x.body[0],"textord");y=Br[Number(T.text)]}}else x=H(x,"textord"),y=Br[Number(x.text)];return Sa({type:"genfrac",mode:r.mode,numer:a,denom:n,continued:!1,hasBarLine:v,barSize:b,leftDelim:o,rightDelim:m},y)}});B({type:"infix",names:["\\above"],numArgs:1,argTypes:["size"],infix:!0,handler(t,e){var r=t.parser;t.funcName;var a=t.token;return{type:"infix",mode:r.mode,replaceWith:"\\\\abovefrac",size:H(e[0],"size").value,token:a}}});B({type:"genfrac",names:["\\\\abovefrac"],numArgs:3,argTypes:["math","size","math"],handler:(t,e)=>{var r=t.parser;t.funcName;var a=e[0],n=H(e[1],"infix").size;if(!n)throw new Error("\\\\abovefrac expected size, but got "+String(n));var s=e[2],o=n.number>0;return{type:"genfrac",mode:r.mode,numer:a,denom:s,continued:!1,hasBarLine:o,barSize:n,leftDelim:null,rightDelim:null}}});var ka=(t,e)=>{var r=e.style,a,n;t.type==="supsub"?(a=t.sup?U(t.sup,e.havingStyle(r.sup()),e):U(t.sub,e.havingStyle(r.sub()),e),n=H(t.base,"horizBrace")):n=H(t,"horizBrace");var s=U(n.base,e.havingBaseStyle($.DISPLAY)),o=Ye(n,e),c;if(n.isOver?c=P({positionType:"firstBaseline",children:[{type:"elem",elem:s},{type:"kern",size:.1},{type:"elem",elem:o,wrapperClasses:["svg-align"]}]}):c=P({positionType:"bottom",positionData:s.depth+.1+o.height,children:[{type:"elem",elem:o,wrapperClasses:["svg-align"]},{type:"kern",size:.1},{type:"elem",elem:s}]}),a){var m=k(["minner",n.isOver?"mover":"munder"],[c],e);n.isOver?c=P({positionType:"firstBaseline",children:[{type:"elem",elem:m},{type:"kern",size:.2},{type:"elem",elem:a}]}):c=P({positionType:"bottom",positionData:m.depth+.2+a.height+a.depth,children:[{type:"elem",elem:a},{type:"kern",size:.2},{type:"elem",elem:m}]})}return k(["minner",n.isOver?"mover":"munder"],[c],e)},Cn=(t,e)=>{var r=je(t.label);return new A(t.isOver?"mover":"munder",[W(t.base,e),r])};B({type:"horizBrace",names:["\\overbrace","\\underbrace","\\overbracket","\\underbracket"],numArgs:1,handler(t,e){var r=t.parser,a=t.funcName;return{type:"horizBrace",mode:r.mode,label:a,isOver:a.includes("\\over"),base:e[0]}},htmlBuilder:ka,mathmlBuilder:Cn});B({type:"href",names:["\\href"],numArgs:2,argTypes:["url","original"],allowedInText:!0,handler:(t,e)=>{var r=t.parser,a=e[1],n=H(e[0],"url").url;return r.settings.isTrusted({command:"\\href",url:n})?{type:"href",mode:r.mode,href:n,body:r0(a)}:r.formatUnsupportedCmd("\\href")},htmlBuilder:(t,e)=>{var r=s0(t.body,e,!1);return B1(t.href,[],r,e)},mathmlBuilder:(t,e)=>{var r=W0(t.body,e);return r instanceof A||(r=new A("mrow",[r])),r.setAttribute("href",t.href),r}});B({type:"href",names:["\\url"],numArgs:1,argTypes:["url"],allowedInText:!0,handler:(t,e)=>{var r=t.parser,a=H(e[0],"url").url;if(!r.settings.isTrusted({command:"\\url",url:a}))return r.formatUnsupportedCmd("\\url");for(var n=[],s=0;s<a.length;s++){var o=a[s];o==="~"&&(o="\\textasciitilde"),n.push({type:"textord",mode:"text",text:o})}var c={type:"text",mode:r.mode,font:"\\texttt",body:n};return{type:"href",mode:r.mode,href:a,body:r0(c)}}});B({type:"hbox",names:["\\hbox"],numArgs:1,argTypes:["text"],allowedInText:!0,primitive:!0,handler(t,e){var r=t.parser;return{type:"hbox",mode:r.mode,body:r0(e[0])}},htmlBuilder(t,e){var r=s0(t.body,e.withFont(""),!1);return $0(r)},mathmlBuilder(t,e){return new A("mrow",g0(t.body,e.withFont("")))}});B({type:"html",names:["\\htmlClass","\\htmlId","\\htmlStyle","\\htmlData"],numArgs:2,argTypes:["raw","original"],allowedInText:!0,handler:(t,e)=>{var r=t.parser,a=t.funcName;t.token;var n=H(e[0],"raw").string,s=e[1];r.settings.strict&&r.settings.reportNonstrict("htmlExtension","HTML extension is disabled on strict mode");var o,c={};switch(a){case"\\htmlClass":c.class=n,o={command:"\\htmlClass",class:n};break;case"\\htmlId":c.id=n,o={command:"\\htmlId",id:n};break;case"\\htmlStyle":c.style=n,o={command:"\\htmlStyle",style:n};break;case"\\htmlData":{for(var m="{,}",d=[],v="",b=0;b<n.length;b++)n.startsWith(m,b)?(v+=",",b+=m.length-1):n[b]===","?(d.push(v),v=""):v+=n[b];d.push(v);for(var y=0;y<d.length;y++){var x=d[y],T=x.indexOf("=");if(T<0)throw new z("\\htmlData key/value '"+x+"' missing equals sign");var q=x.slice(0,T),D=x.slice(T+1);c["data-"+q.trim()]=D}o={command:"\\htmlData",attributes:c};break}default:throw new Error("Unrecognized html command")}return r.settings.isTrusted(o)?{type:"html",mode:r.mode,attributes:c,body:r0(s)}:r.formatUnsupportedCmd(a)},htmlBuilder:(t,e)=>{var r=s0(t.body,e,!1),a=["enclosing"];t.attributes.class&&a.push(...t.attributes.class.trim().split(/\s+/));var n=k(a,r,e);for(var s of Object.entries(t.attributes)){var o=s[0],c=s[1];o!=="class"&&n.setAttribute(o,c)}return n},mathmlBuilder:(t,e)=>W0(t.body,e)});B({type:"htmlmathml",names:["\\html@mathml"],numArgs:2,allowedInArgument:!0,allowedInText:!0,handler:(t,e)=>{var r=t.parser;return{type:"htmlmathml",mode:r.mode,html:r0(e[0]),mathml:r0(e[1])}},htmlBuilder:(t,e)=>{var r=s0(t.html,e,!1);return $0(r)},mathmlBuilder:(t,e)=>W0(t.mathml,e)});var ft=function(e){if(/^[-+]? *(\d+(\.\d*)?|\.\d+)$/.test(e))return{number:+e,unit:"bp"};var r=/([-+]?) *(\d+(?:\.\d*)?|\.\d+) *([a-z]{2})/.exec(e);if(!r)throw new z("Invalid size: '"+e+"' in \\includegraphics");var a={number:+(r[1]+r[2]),unit:r[3]};if(!Wr(a))throw new z("Invalid unit: '"+a.unit+"' in \\includegraphics.");return a};B({type:"includegraphics",names:["\\includegraphics"],numArgs:1,numOptionalArgs:1,argTypes:["raw","url"],allowedInText:!1,handler:(t,e,r)=>{var a=t.parser,n={number:0,unit:"em"},s={number:.9,unit:"em"},o={number:0,unit:"em"},c="";if(r[0])for(var m=H(r[0],"raw").string,d=m.split(","),v=0;v<d.length;v++){var b=d[v].split("=");if(b.length===2){var y=b[1].trim();switch(b[0].trim()){case"alt":c=y;break;case"width":n=ft(y);break;case"height":s=ft(y);break;case"totalheight":o=ft(y);break;default:throw new z("Invalid key: '"+b[0]+"' in \\includegraphics.")}}}var x=H(e[0],"url").url;return c===""&&(c=x,c=c.replace(/^.*[\\/]/,""),c=c.substring(0,c.lastIndexOf("."))),a.settings.isTrusted({command:"\\includegraphics",url:x})?{type:"includegraphics",mode:a.mode,alt:c,width:n,height:s,totalheight:o,src:x}:a.formatUnsupportedCmd("\\includegraphics")},htmlBuilder:(t,e)=>{var r=e0(t.height,e),a=0;t.totalheight.number>0&&(a=e0(t.totalheight,e)-r);var n=0;t.width.number>0&&(n=e0(t.width,e));var s={height:M(r+a)};n>0&&(s.width=M(n)),a>0&&(s.verticalAlign=M(-a));var o=new xt(t.src,t.alt,s);return o.height=r,o.depth=a,o},mathmlBuilder:(t,e)=>{var r=new A("mglyph",[]);r.setAttribute("alt",t.alt);var a=e0(t.height,e),n=0;if(t.totalheight.number>0&&(n=e0(t.totalheight,e)-a,r.setAttribute("valign",M(-n))),r.setAttribute("height",M(a+n)),t.width.number>0){var s=e0(t.width,e);r.setAttribute("width",M(s))}return r.setAttribute("src",t.src),r}});B({type:"kern",names:["\\kern","\\mkern","\\hskip","\\mskip"],numArgs:1,argTypes:["size"],primitive:!0,allowedInText:!0,handler(t,e){var r=t.parser,a=t.funcName,n=H(e[0],"size");if(r.settings.strict){var s=a[1]==="m",o=n.value.unit==="mu";s?(o||r.settings.reportNonstrict("mathVsTextUnits","LaTeX's "+a+" supports only mu units, "+("not "+n.value.unit+" units")),r.mode!=="math"&&r.settings.reportNonstrict("mathVsTextUnits","LaTeX's "+a+" works only in math mode")):o&&r.settings.reportNonstrict("mathVsTextUnits","LaTeX's "+a+" doesn't support mu units")}return{type:"kern",mode:r.mode,dimension:n.value}},htmlBuilder(t,e){return Qr(t.dimension,e)},mathmlBuilder(t,e){var r=e0(t.dimension,e);return new Ge(r)}});B({type:"lap",names:["\\mathllap","\\mathrlap","\\mathclap"],numArgs:1,allowedInText:!0,handler:(t,e)=>{var r=t.parser,a=t.funcName,n=e[0];return{type:"lap",mode:r.mode,alignment:a.slice(5),body:n}},htmlBuilder:(t,e)=>{var r;t.alignment==="clap"?(r=k([],[U(t.body,e)]),r=k(["katex-inner"],[r],e)):r=k(["katex-inner"],[U(t.body,e)]);var a=k(["katex-fix"],[]),n=k([t.alignment],[r,a],e),s=k(["katex-strut"]);return s.style.height=M(n.height+n.depth),n.depth&&(s.style.verticalAlign=M(-n.depth)),n.children.unshift(s),n=k(["katex-thinbox"],[n],e),k(["mord","katex-vbox"],[n],e)},mathmlBuilder:(t,e)=>{var r=new A("mpadded",[W(t.body,e)]);if(t.alignment!=="rlap"){var a=t.alignment==="llap"?"-1":"-0.5";r.setAttribute("lspace",a+"width")}return r.setAttribute("width","0px"),r}});B({type:"styling",names:["\\(","$"],numArgs:0,allowedInText:!0,allowedInMath:!1,handler(t,e){var r=t.funcName,a=t.parser,n=a.mode;a.switchMode("math");var s=r==="\\("?"\\)":"$",o=a.parseExpression(!1,s);return a.expect(s),a.switchMode(n),{type:"styling",mode:a.mode,style:"text",resetFont:!0,body:o}}});B({type:"text",names:["\\)","\\]"],numArgs:0,allowedInText:!0,allowedInMath:!1,handler(t,e){throw new z("Mismatched "+t.funcName)}});var Or=(t,e)=>{switch(e.style.size){case $.DISPLAY.size:return t.display;case $.TEXT.size:return t.text;case $.SCRIPT.size:return t.script;case $.SCRIPTSCRIPT.size:return t.scriptscript;default:return t.text}};B({type:"mathchoice",names:["\\mathchoice"],numArgs:4,primitive:!0,handler:(t,e)=>{var r=t.parser;return{type:"mathchoice",mode:r.mode,display:r0(e[0]),text:r0(e[1]),script:r0(e[2]),scriptscript:r0(e[3])}},htmlBuilder:(t,e)=>{var r=Or(t,e),a=s0(r,e,!1);return $0(a)},mathmlBuilder:(t,e)=>{var r=Or(t,e);return W0(r,e)}});var za=(t,e,r,a,n,s,o)=>{t=k([],[t]);var c=r&&I0(r),m,d;if(e){var v=U(e,a.havingStyle(n.sup()),a);d={elem:v,kern:Math.max(a.fontMetrics().bigOpSpacing1,a.fontMetrics().bigOpSpacing3-v.depth)}}if(r){var b=U(r,a.havingStyle(n.sub()),a);m={elem:b,kern:Math.max(a.fontMetrics().bigOpSpacing2,a.fontMetrics().bigOpSpacing4-b.height)}}var y;if(d&&m){var x=a.fontMetrics().bigOpSpacing5+m.elem.height+m.elem.depth+m.kern+t.depth+o;y=P({positionType:"bottom",positionData:x,children:[{type:"kern",size:a.fontMetrics().bigOpSpacing5},{type:"elem",elem:m.elem,marginLeft:M(-s)},{type:"kern",size:m.kern},{type:"elem",elem:t},{type:"kern",size:d.kern},{type:"elem",elem:d.elem,marginLeft:M(s)},{type:"kern",size:a.fontMetrics().bigOpSpacing5}]})}else if(m){var T=t.height-o;y=P({positionType:"top",positionData:T,children:[{type:"kern",size:a.fontMetrics().bigOpSpacing5},{type:"elem",elem:m.elem,marginLeft:M(-s)},{type:"kern",size:m.kern},{type:"elem",elem:t}]})}else if(d){var q=t.depth+o;y=P({positionType:"bottom",positionData:q,children:[{type:"elem",elem:t},{type:"kern",size:d.kern},{type:"elem",elem:d.elem,marginLeft:M(s)},{type:"kern",size:a.fontMetrics().bigOpSpacing5}]})}else return t;var D=[y];if(m&&s!==0&&!c){var C=k(["mspace"],[],a);C.style.marginRight=M(s),D.unshift(C)}return k(["mop","op-limits"],D,a)},Aa=new Set(["\\smallint"]),Ta=(t,e)=>{var r,a,n=!1,s;t.type==="supsub"?(r=t.sup,a=t.sub,s=H(t.base,"op"),n=!0):s=H(t,"op");var o=e.style,c=!1;o.size===$.DISPLAY.size&&s.symbol&&!Aa.has(s.name)&&(c=!0);var m,d;if(s.symbol){var v=c?"Size2-Regular":"Size1-Regular",b="";if((s.name==="\\oiint"||s.name==="\\oiiint")&&(b=s.name.slice(1),s.name=b==="oiint"?"\\iint":"\\iiint"),m=u0(s.name,v,"math",e,["mop","op-symbol",c?"large-op":"small-op"]),d=m.italic,b.length>0){var y=ta(b+"Size"+(c?"2":"1"),e);m=P({positionType:"individualShift",children:[{type:"elem",elem:m,shift:0},{type:"elem",elem:y,shift:c?.08:0}]}),s.name="\\"+b,m.classes.unshift("mop"),m.italic=d}}else if(s.body){var x=s0(s.body,e,!0);x.length===1&&x[0]instanceof h0?(m=x[0],m.classes[0]="mop"):m=k(["mop"],x,e)}else{for(var T=[],q=1;q<s.name.length;q++)T.push(Lt(s.name[q],s.mode,e));m=k(["mop"],T,e)}var D=0,C=0;if((m instanceof h0||s.name==="\\oiint"||s.name==="\\oiiint")&&!s.suppressBaseShift){var O;D=(m.height-m.depth)/2-e.fontMetrics().axisHeight,C=(O=m.italic)!=null?O:0}return n?za(m,r,a,e,o,C,D):(D&&(m.style.position="relative",m.style.top=M(D)),m)},Bn=(t,e)=>{var r;if(t.symbol)r=new A("mo",[y0(t.name,t.mode)]),Aa.has(t.name)&&r.setAttribute("largeop","false");else if(t.body)r=new A("mo",g0(t.body,e));else{r=new A("mi",[new t0(t.name.slice(1))]);var a=new A("mo",[y0("\u2061","text")]);t.parentIsSupSub?r=new A("mrow",[r,a]):r=na([r,a])}return r},En={"\u220F":"\\prod","\u2210":"\\coprod","\u2211":"\\sum","\u22C0":"\\bigwedge","\u22C1":"\\bigvee","\u22C2":"\\bigcap","\u22C3":"\\bigcup","\u2A00":"\\bigodot","\u2A01":"\\bigoplus","\u2A02":"\\bigotimes","\u2A04":"\\biguplus","\u2A06":"\\bigsqcup"};B({type:"op",names:["\\coprod","\\bigvee","\\bigwedge","\\biguplus","\\bigcap","\\bigcup","\\intop","\\prod","\\sum","\\bigotimes","\\bigoplus","\\bigodot","\\bigsqcup","\\smallint","\u220F","\u2210","\u2211","\u22C0","\u22C1","\u22C2","\u22C3","\u2A00","\u2A01","\u2A02","\u2A04","\u2A06"],numArgs:0,handler:(t,e)=>{var r=t.parser,a=t.funcName,n=a;return n.length===1&&(n=En[n]),{type:"op",mode:r.mode,limits:!0,parentIsSupSub:!1,symbol:!0,name:n}},htmlBuilder:Ta,mathmlBuilder:Bn});B({type:"op",names:["\\mathop"],numArgs:1,primitive:!0,handler:(t,e)=>{var r=t.parser,a=e[0];return{type:"op",mode:r.mode,limits:!1,parentIsSupSub:!1,symbol:!1,body:r0(a)}}});var On={"\u222B":"\\int","\u222C":"\\iint","\u222D":"\\iiint","\u222E":"\\oint","\u222F":"\\oiint","\u2230":"\\oiiint"};B({type:"op",names:["\\arcsin","\\arccos","\\arctan","\\arctg","\\arcctg","\\arg","\\ch","\\cos","\\cosec","\\cosh","\\cot","\\cotg","\\coth","\\csc","\\ctg","\\cth","\\deg","\\dim","\\exp","\\hom","\\ker","\\lg","\\ln","\\log","\\sec","\\sin","\\sinh","\\sh","\\tan","\\tanh","\\tg","\\th"],numArgs:0,handler(t){var e=t.parser,r=t.funcName;return{type:"op",mode:e.mode,limits:!1,parentIsSupSub:!1,symbol:!1,name:r}}});B({type:"op",names:["\\det","\\gcd","\\inf","\\lim","\\max","\\min","\\Pr","\\sup"],numArgs:0,handler(t){var e=t.parser,r=t.funcName;return{type:"op",mode:e.mode,limits:!0,parentIsSupSub:!1,symbol:!1,name:r}}});B({type:"op",names:["\\int","\\iint","\\iiint","\\oint","\\oiint","\\oiiint","\u222B","\u222C","\u222D","\u222E","\u222F","\u2230"],numArgs:0,allowedInArgument:!0,handler(t){var e=t.parser,r=t.funcName,a=r;return a.length===1&&(a=On[a]),{type:"op",mode:e.mode,limits:!1,parentIsSupSub:!1,symbol:!0,name:a}}});var Ma=(t,e)=>{var r,a,n=!1,s;t.type==="supsub"?(r=t.sup,a=t.sub,s=H(t.base,"operatorname"),n=!0):s=H(t,"operatorname");var o;if(s.body.length>0){for(var c=s.body.map(b=>{var y="text"in b?b.text:void 0;return typeof y=="string"?{type:"textord",mode:b.mode,text:y}:b}),m=s0(c,e.withFont("mathrm"),!0),d=0;d<m.length;d++){var v=m[d];v instanceof h0&&(v.text=v.text.replace(/\u2212/,"-").replace(/\u2217/,"*"))}o=k(["mop"],m,e)}else o=k(["mop"],[],e);return n?za(o,r,a,e,e.style,0,0):o},_n=(t,e)=>{for(var r=g0(t.body,e.withFont("mathrm")),a=!0,n=0;n<r.length;n++){var s=r[n];if(!(s instanceof Ge))if(s instanceof A)switch(s.type){case"mi":case"mn":case"mspace":case"mtext":break;case"mo":{var o=s.children[0];s.children.length===1&&o instanceof t0?o.text=o.text.replace(/\u2212/,"-").replace(/\u2217/,"*"):a=!1;break}default:a=!1}else a=!1}if(a){var c=r.map(v=>v.toText()).join("");r=[new t0(c)]}var m=new A("mi",r);m.setAttribute("mathvariant","normal");var d=new A("mo",[y0("\u2061","text")]);return t.parentIsSupSub?new A("mrow",[m,d]):na([m,d])};B({type:"operatorname",names:["\\operatorname@","\\operatornamewithlimits"],numArgs:1,handler:(t,e)=>{var r=t.parser,a=t.funcName,n=e[0];return{type:"operatorname",mode:r.mode,body:r0(n),alwaysHandleSupSub:a==="\\operatornamewithlimits",limits:!1,parentIsSupSub:!1}},htmlBuilder:Ma,mathmlBuilder:_n});h("\\operatorname","\\@ifstar\\operatornamewithlimits\\operatorname@");K0({type:"ordgroup",htmlB...[truncated] -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /.github/dependabot.yml line 4
- Likely real
- Yes, 99% confidence
This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown
- package-ecosystem: "gomod" directory: "/" schedule: interval: "daily" -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /releaser/releaser.go line 119
- Likely real
- Yes, 96% confidence
Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read]
// Hugoreleaser will do the actual release using these values. if err := r.replaceInFile("hugoreleaser.env", `HUGORELEASER_TAG=(\S*)`, "HUGORELEASER_TAG="+tag, `HUGORELEASER_COMMITISH=(\S*)`, "HUGORELEASER_COMMITISH="+sha, -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /resources/page/hugoinfo.go line 58
- Likely real
- Yes, 83% confidence
Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.
return template.HTML(fmt.Sprintf(`<meta name="generator" content="Hugo %s">`, hugo.CurrentVersion.String())) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /hugolib/page__content.go line 581
- Likely real
- Yes, 83% confidence
Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.
result.contentWithoutSummary = template.HTML(summarized.ContentWithoutSummary()) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /tpl/transform/transform.go line 94
- Likely real
- Yes, 82% confidence
Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.
return template.HTML(helpers.Emojify([]byte(ss))), nil -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /tpl/safe/safe.go line 53
- Likely real
- Yes, 82% confidence
Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.
return template.JS(ss), err -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /tpl/safe/safe.go line 59
- Likely real
- Yes, 82% confidence
Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.
return template.JSStr(ss), err -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /tpl/strings/strings.go line 132
- Likely real
- Yes, 82% confidence
Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.
return template.HTML(res), nil -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /tpl/strings/truncate.go line 81
- Likely real
- Yes, 82% confidence
Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.
return template.HTML(text), nil -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /tpl/strings/truncate.go line 83
- Likely real
- Yes, 82% confidence
Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.
return template.HTML(html.EscapeString(text)), nil -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /tpl/strings/truncate.go line 152
- Likely real
- Yes, 82% confidence
Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.
return template.HTML(out.String()), nil -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /tpl/strings/truncate.go line 154
- Likely real
- Yes, 82% confidence
Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.
return template.HTML(html.EscapeString(out.String()) + ellipsis), nil -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /tpl/strings/truncate.go line 159
- Likely real
- Yes, 82% confidence
Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.
return template.HTML(text), nil -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /tpl/strings/truncate.go line 161
- Likely real
- Yes, 82% confidence
Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.
return template.HTML(html.EscapeString(text)), nil -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /tpl/safe/safe.go line 65
- Likely real
- Yes, 82% confidence
Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.
return template.URL(ss), err -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /tpl/transform/transform.go line 144
- Likely real
- Yes, 82% confidence
Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.
return template.HTML(highlighted), nil -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /tpl/transform/transform.go line 237
- Likely real
- Yes, 82% confidence
Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.
return template.HTML(tpl.StripHTML(ss)), nil -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /tpl/transform/transform.go line 348
- Likely real
- Yes, 82% confidence
Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.
return template.HTML(e.Output), err -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /hugolib/page__content.go line 582
- Likely real
- Yes, 82% confidence
Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.
result.content = template.HTML(summarized.Content()) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /common/types/hstring/stringtypes.go line 35
- Likely real
- Yes, 82% confidence
Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.
return template.HTML(s) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /helpers/content.go line 91
- Likely real
- Yes, 82% confidence
Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.
return template.HTML(string(b)) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /hugolib/page__content.go line 577
- Likely real
- Yes, 82% confidence
Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.
Text: template.HTML(summarized.Summary()), -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /hugolib/shortcode.go line 500
- Likely real
- Yes, 82% confidence
Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.
data.Inner = template.HTML(newInner) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /hugolib/page__content.go line 584
- Likely real
- Yes, 82% confidence
Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.
result.content = template.HTML(string(b)) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /hugolib/page__content.go line 592
- Likely real
- Yes, 82% confidence
Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.
Text: template.HTML(summary.Summary()), -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /hugolib/page__content.go line 596
- Likely real
- Yes, 82% confidence
Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.
result.contentWithoutSummary = template.HTML(summary.ContentWithoutSummary()) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /hugolib/page__content.go line 1039
- Likely real
- Yes, 82% confidence
Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.
return template.HTML(string(rendered)), nil -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /hugolib/page__content.go line 1108
- Likely real
- Yes, 82% confidence
Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.
return template.HTML(hugocontext.Wrap(cc, pco.po.p.pid)), nil -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /hugolib/page__per_output.go line 138
- Likely real
- Yes, 82% confidence
Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.
return template.HTML(res), nil -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /hugolib/shortcode.go line 95
- Likely real
- Yes, 82% confidence
Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.
scp.innerDeindent = template.HTML(b.String()) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /tpl/safe/safe.go line 47
- Likely real
- Yes, 82% confidence
Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.
return template.HTMLAttr(ss), err -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /hugolib/shortcode.go line 502
- Likely real
- Yes, 82% confidence
Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.
data.Inner = template.HTML(inner.String()) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /hugolib/shortcode_page.go line 86
- Likely real
- Yes, 82% confidence
Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.
toc: template.HTML(tocShortcodePlaceholder), -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /markup/highlight/highlight.go line 119
- Likely real
- Yes, 82% confidence
Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.
highlighted: template.HTML(highlighted), -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /markup/tableofcontents/tableofcontents.go line 174
- Likely real
- Yes, 82% confidence
Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.
return template.HTML(b.s.String()), nil -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /tpl/diagrams/goat.go line 32
- Likely real
- Yes, 82% confidence
Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.
return template.HTML(d.d.Body) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /tpl/diagrams/goat.go line 36
- Likely real
- Yes, 82% confidence
Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.
return template.HTML(d.d.String()) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /tpl/encoding/encoding.go line 132
- Likely real
- Yes, 82% confidence
Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.
return template.HTML(b), nil -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /tpl/partials/partials.go line 171
- Likely real
- Yes, 82% confidence
Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.
result = template.HTML(b.String()) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /tpl/safe/safe.go line 35
- Likely real
- Yes, 82% confidence
Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.
return template.CSS(ss), err -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /tpl/safe/safe.go line 41
- Likely real
- Yes, 82% confidence
Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.
return template.HTML(ss), err -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /livereload/livereload.go line 96
- Likely real
- Yes, 77% confidence
The Origin header in the HTTP WebSocket handshake is used to guarantee that the connection accepted by the WebSocket is from a trusted origin domain. Failure to enforce can lead to Cross Site Request Forgery (CSRF). As per "gorilla/websocket" documentation: "A CheckOrigin function should carefully validate the request origin to prevent cross-site request forgery."
ws, err := upgrader.Upgrade(w, r, nil) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /helpers/general.go line 39
- Likely real
- Yes, 77% confidence
Detected a network listener listening on 0.0.0.0 or an empty string. This could unexpectedly expose the server publicly as it binds to all available interfaces. Instead, specify another IP address that is not 0.0.0.0 nor the empty string.
l, err := net.Listen("tcp", ":0") -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /commands/server.go line 364
- Likely real
- Yes, 57% confidence
An HTTP redirect was found to be crafted from user-input `r`. This can lead to open redirect vulnerabilities, potentially allowing attackers to redirect users to malicious web sites. It is recommend where possible to not allow user-input to craft the redirect URL. When user-input is necessary to craft the request, it is recommended to follow OWASP best practices to restrict the URL to domains in an allowlist.
http.Redirect(w, r, redirect.To, redirect.Status) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /commands/server.go line 385
- Likely real
- Yes, 57% confidence
An HTTP redirect was found to be crafted from user-input `r`. This can lead to open redirect vulnerabilities, potentially allowing attackers to redirect users to malicious web sites. It is recommend where possible to not allow user-input to craft the redirect URL. When user-input is necessary to craft the request, it is recommended to follow OWASP best practices to restrict the URL to domains in an allowlist.
http.Redirect(w, r, requestURI, http.StatusMovedPermanently) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /commands/server.go line 292
- Likely real
- Yes, 56% confidence
Detected 'Fprintf' or similar writing to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users.
fmt.Fprint(w, injectLiveReloadScript(r, lr)) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /resources/resource_transformers/integrity/integrity.go line 86
- Likely real
- Yes, 53% confidence
Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.
return md5.New(), nil -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /tpl/crypto/crypto.go line 45
- Likely real
- Yes, 53% confidence
Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.
hash := md5.Sum([]byte(conv)) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /tpl/crypto/crypto.go line 56
- Likely real
- Yes, 53% confidence
Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.
hash := sha1.Sum([]byte(conv)) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /tpl/crypto/crypto.go line 113
- Likely real
- Yes, 53% confidence
Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.
return md5.New(), nil -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /tpl/crypto/crypto.go line 115
- Likely real
- Yes, 53% confidence
Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.
return sha1.New(), nil -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /deploy/deploy.go line 460
- Likely real
- Yes, 51% confidence
Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.
h := md5.New() -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /deploy/deploy.go line 617
- Likely real
- Yes, 51% confidence
Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.
h := md5.New() -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /common/hashing/hashing.go line 104
- Likely real
- Yes, 51% confidence
Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.
h := md5.New() -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /common/hashing/hashing.go line 111
- Likely real
- Yes, 51% confidence
Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.
h := md5.New() -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /commands/server.go line 489
- Likely real
- Uncertain, 48% confidence
Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information.
http.ListenAndServe("localhost:8080", nil) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /livereload/livereload.go line 144
- Likely real
- Uncertain, 46% confidence
Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'.
w.Write(liveReloadJS()) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /tpl/internal/go_templates/texttemplate/hugo_template.go line 263
- Likely real
- Uncertain, 46% confidence
If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner.
method = ptr.MethodByName(fieldName) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /tpl/internal/go_templates/texttemplate/hugo_template.go line 325
- Likely real
- Uncertain, 46% confidence
If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner.
if _, ok := etyp.FieldByName(fieldName); !ok { -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /tpl/internal/go_templates/texttemplate/hugo_template.go line 281
- Likely real
- Uncertain, 46% confidence
If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner.
tField, ok := receiver.Type().FieldByName(fieldName) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /tpl/internal/go_templates/texttemplate/hugo_template.go line 274
- Likely real
- Uncertain, 46% confidence
If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner.
if method := ptr.MethodByName(fieldName); method.IsValid() { -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /tpl/internal/go_templates/texttemplate/exec.go line 749
- Likely real
- Uncertain, 46% confidence
If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner.
if _, ok := etyp.FieldByName(fieldName); !ok { -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /tpl/internal/go_templates/texttemplate/exec.go line 704
- Likely real
- Uncertain, 46% confidence
If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner.
if method := ptr.MethodByName(fieldName); method.IsValid() { -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /tpl/collections/where.go line 501
- Likely real
- Uncertain, 46% confidence
If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner.
mt, ok := ifaceType.MethodByName(name) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /tpl/collections/where.go line 420
- Likely real
- Uncertain, 46% confidence
If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner.
ft, ok := baseType.FieldByName(name) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /tpl/collections/where.go line 318
- Likely real
- Uncertain, 46% confidence
If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner.
ft, ok := obj.Type().FieldByName(elemName) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /resources/postpub/postpub.go line 128
- Likely real
- Uncertain, 46% confidence
If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner.
v := receiverv.FieldByName(fieldname) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /common/hreflect/helpers.go line 180
- Likely real
- Uncertain, 46% confidence
If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner.
m, _ := tp.MethodByName(name) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /common/hreflect/helpers.go line 204
- Likely real
- Uncertain, 46% confidence
If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner.
m, ok := tp.MethodByName(name) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /common/hreflect/helpers.go line 293
- Likely real
- Uncertain, 46% confidence
If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner.
fn := v.MethodByName(name) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /tpl/internal/go_templates/texttemplate/exec.go line 711
- Likely real
- Uncertain, 46% confidence
If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner.
tField, ok := receiver.Type().FieldByName(fieldName) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /resources/page/pagegroup.go line 141
- Likely real
- Uncertain, 46% confidence
If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner.
ft, ok = pagePtrType.Elem().FieldByName(key) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /resources/page/pagegroup.go line 160
- Likely real
- Uncertain, 46% confidence
If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner.
fv = ppv.Elem().FieldByName(key) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /tpl/math/math.go line 21
- Likely real
- Uncertain, 39% confidence
Do not use `math/rand`. Use `crypto/rand` instead.
"math/rand" -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /resources/resource_factories/create/remote.go line 22
- Likely real
- Uncertain, 39% confidence
Do not use `math/rand`. Use `crypto/rand` instead.
"math/rand" -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /resources/page/pages.go line 18
- Likely real
- Uncertain, 39% confidence
Do not use `math/rand`. Use `crypto/rand` instead.
"math/rand" -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /hugolib/integrationtest_builder.go line 10
- Likely real
- Uncertain, 39% confidence
Do not use `math/rand`. Use `crypto/rand` instead.
"math/rand" -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /tpl/collections/vitter.go line 9
- Likely real
- Uncertain, 38% confidence
Do not use `math/rand`. Use `crypto/rand` instead.
"math/rand/v2" -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /tpl/collections/collections.go line 22
- Likely real
- Uncertain, 38% confidence
Do not use `math/rand`. Use `crypto/rand` instead.
"math/rand/v2" -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /tpl/tplimpl/embedded/templates/_shortcodes/instagram.html line 243
- Likely real
- Uncertain, 36% confidence
This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files.
<script async src="https://www.instagram.com/embed.js"></script> -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /tpl/internal/go_templates/htmltemplate/js.go line 21
- Likely real
- Yes, 95% confidence
Detects heavy obfuscation techniques commonly used by malware [threat-runtime-obfuscation]
...r_expressions/Character_classes. const jsWhitespace = "\f\n\r\t\v\u0020\u00a0\u1680\u2000\u2001\u2002\u2003\u2004\u2005\u2006\u2007\u2008\u2009\u200a\u2028\u2029\u202f\u205f\u3000\ufeff" // nextJSCtx returns the context that determines whether a sla... -
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /hugolib/testdata/redis.cn.md
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
No findings match these filters.