Security Horizontal Review

Dear Group, this is a finding from the Security Review.

Reviewed version: 4 June 2026 MathML 4 Working Draft.

Related privacy review and specification updates: w3c/mathml issue #576

Recursive intent reference processing is not explicitly bounded

Concern: MathML 4 allows an intent expression to contain repeated references to a descendant, and allows each reference to be replaced by that element's effective intent. The intent grammar permits nested applications and multiple arguments, including the same reference more than once and the current error-recovery rules do not define a processing limit or the fallback when a resource limit is reached.

Impact: An implementation that recursively expands repeated effective intents without structural sharing, caching, or a work limit may consume CPU or memory disproportionate to the source size. Because intent is author-controlled input and is processed for accessibility output, this could delay or disrupt that output in affected implementations.

Recommendation: Could the Group clarify whether processors are expected to bound recursive intent processing by depth, total work, output size, or an equivalent mechanism? If so, the specification should also define predictable fallback behavior when an implementation limit is reached. If the Group considers generic host resource limits sufficient, documenting that decision and the expected fallback in the Security Considerations would make the intended scope clear.

Affected sections:

• https://www.w3.org/TR/2026/WD-mathml4-20260604/#mixing_intent_grammar
• https://www.w3.org/TR/2026/WD-mathml4-20260604/#mixing_intent_argref
• https://www.w3.org/TR/2026/WD-mathml4-20260604/#mixing_intent_errors
• https://www.w3.org/TR/2026/WD-mathml4-20260604/#security_intent

Thanks,

Simone

Start by reading the affected MathML sections on intent grammar, argument references, errors, and security, along with the linked privacy review and security review. Confirm how recursive processing limits and resource-limit fallback should be specified; done means the Group's decision is documented in the relevant specification sections or Security Considerations.