From 4238b9b3efc3a9c001b5e1cf6c1883ffd0f92800 Mon Sep 17 00:00:00 2001 From: Literallie Date: Wed, 18 Oct 2017 19:37:55 +0200 Subject: Fix MathJax CSP issues --- app.js | 14 +++++++------- public/js/mathjax-config-extra.js | 8 ++++++++ public/views/hackmd/foot.ejs | 4 +--- public/views/pretty.ejs | 4 +--- public/views/slide.ejs | 4 +--- 5 files changed, 18 insertions(+), 16 deletions(-) create mode 100644 public/js/mathjax-config-extra.js diff --git a/app.js b/app.js index b78f94e1..88735854 100644 --- a/app.js +++ b/app.js @@ -118,22 +118,22 @@ app.use((req, res, next) => { // https://helmetjs.github.io/docs/csp/ if (config.csp.enable) { var cdnDirectives = { - scriptSrc: ["https://cdnjs.cloudflare.com"], - styleSrc: ["https://cdnjs.cloudflare.com", "https://fonts.googleapis.com"], - fontSrc: ["https://cdnjs.cloudflare.com", "https://fonts.gstatic.com"] + scriptSrc: ['https://cdnjs.cloudflare.com', 'https://cdn.mathjax.org'], + styleSrc: ['https://cdnjs.cloudflare.com', 'https://fonts.googleapis.com'], + fontSrc: ['https://cdnjs.cloudflare.com', 'https://fonts.gstatic.com'] } var directives = {} for (var propertyName in config.csp.directives) { - if(config.csp.directives.hasOwnProperty(propertyName)) { + if (config.csp.directives.hasOwnProperty(propertyName)) { var directive = config.csp.directives[propertyName] if (config.usecdn && !!cdnDirectives[propertyName]) { directive = directive.concat(cdnDirectives[propertyName]) } - directives[propertyName] = directive; + directives[propertyName] = directive } } directives.scriptSrc.push(function (req, res) { return "'nonce-" + res.locals.nonce + "'" }) - if(config.csp.upgradeInsecureRequests === 'auto') { + if (config.csp.upgradeInsecureRequests === 'auto') { directives.upgradeInsecureRequests = config.usessl === 'true' } else { directives.upgradeInsecureRequests = config.csp.upgradeInsecureRequests === 'true' @@ -142,7 +142,7 @@ if (config.csp.enable) { directives: directives })) } else { - logger.info('Content-Security-Policy is disabled. This may be a security risk.'); + logger.info('Content-Security-Policy is disabled. This may be a security risk.') } i18n.configure({ diff --git a/public/js/mathjax-config-extra.js b/public/js/mathjax-config-extra.js new file mode 100644 index 00000000..54cee794 --- /dev/null +++ b/public/js/mathjax-config-extra.js @@ -0,0 +1,8 @@ +var MathJax = { + messageStyle: 'none', + skipStartupTypeset: true, + tex2jax: { + inlineMath: [['$', '$'], ['\\(', '\\)']], + processEscapes: true + } +} diff --git a/public/views/hackmd/foot.ejs b/public/views/hackmd/foot.ejs index 6a1f3b99..8438dce2 100644 --- a/public/views/hackmd/foot.ejs +++ b/public/views/hackmd/foot.ejs @@ -1,6 +1,4 @@ - + <% if(useCDN) { %> diff --git a/public/views/pretty.ejs b/public/views/pretty.ejs index 80d2505c..b2988e39 100644 --- a/public/views/pretty.ejs +++ b/public/views/pretty.ejs @@ -72,9 +72,7 @@ - + <% if(useCDN) { %> diff --git a/public/views/slide.ejs b/public/views/slide.ejs index c7dd9898..269ce044 100644 --- a/public/views/slide.ejs +++ b/public/views/slide.ejs @@ -89,9 +89,7 @@ - + <% if(useCDN) { %> -- cgit v1.2.3