[1.3.4] MathJax \class (and \cssId) no longer work

[eth-p]

Steps to reproduce

Setup Steps:

• Open the sandbox vault.

Method 1: Seeing MathJax output through JavaScript.

• Open the Formatting/Math.md file to load MathJax.
• Open the devtools (Command+Option+I on Mac)
• Run MathJax.tex2chtml("\\class{my-class}{1+2 = 3}")

Method 2: Using MathJax in Markdown

• Create a CSS snippet.
  • Add the following to it: .my-class { color: red; }
  • Enable teh snippet.
• Put $\class{my-class}{1+2} = 3$ inside a Markdown document.
• View the rendered MathJax in either live preview, or reading mode.

Did you follow the troubleshooting guide? [Y/N]

Yes.

Expected result

Method 1:
The returned Element, when expanded, will contain:

<mjx-mrow class="my-class">
    ...
</mjx-mrow>

Method 2:
The “1 + 2” in the rendered MathJax will be wrapped in a mjx-mrow providing class="my-class", which will cause it to be red.

Actual result

Method 1:
The mjx-mrow will not have a class attribute.

Method 2:
The math will not be colored.

Environment

SYSTEM INFO:
Obsidian version: v1.3.5
Installer version: v1.1.9
Operating system: Darwin Kernel Version 22.5.0: Mon Apr 24 20:52:24 PDT 2023; root:xnu-8796.121.2~5/RELEASE_ARM64_T6000 22.5.0
Login status: not logged in
Insider build toggle: off
Live preview: on
Legacy editor: off
Base theme: dark
Community theme: none
Snippets enabled: 1
Restricted mode: on

RECOMMENDATIONS:
Custom theme and snippets: for cosmetic issues, please first try updating your theme and disabling your snippets. If still not fixed, please try to make the issue happen in the Sandbox Vault or disable community theme and snippets.

---

Additional information

I went through the releases on your GitHub to see when this broke, and it last worked in 1.3.3. The change that broke it was possibly “prevent math from inserting links that execute JavaScript when clicked on.”

Having this feature was extremely useful for taking math notes. Using the Extended MathJax plugin with a global preamble and a CSS snippet allowed me to make macros that would highlight/change the color of certain variables in math equations, making them much more readable and easy to follow.

[WhiteNoise]

We now run mathjax with Safe Extension Options and default settings.

Whatever you do, you must follow those restrictions and we are not gonna change them.

[eth-p]

I’m not claiming that it’s a bad thing to use the safe extension feature, but would it be possible to consider explicitly supporting the classes: "safe" in the configuration block?

According to the devtools and inspecting MathJax.config.options.safeOptions, everything is set to the defaults. The defaults provided by MathJax allow mjx--prefixed classes, but lacking official support or acknowledgement from the Obsidian developers, it’s merely a workaround that could be patched out in the future.

That being said, I agree that allowing MathJax expressions to render javascript: links and the like is a significant security risk and should be prevented. However, I feel that custom classes are a useful feature with limited scope for abuse. As long as its set to safe and uses a classPattern that prevents clashing with CSS classes that are used as part of Obsidian or any of its components, the only way it could be used to break something is if the user intentionally enabled a CSS snippet containing a class designed for that purpose.