From 4238b9b3efc3a9c001b5e1cf6c1883ffd0f92800 Mon Sep 17 00:00:00 2001
From: Literallie
Date: Wed, 18 Oct 2017 19:37:55 +0200
Subject: Fix MathJax CSP issues
---
app.js | 14 +++++++-------
public/js/mathjax-config-extra.js | 8 ++++++++
public/views/hackmd/foot.ejs | 4 +---
public/views/pretty.ejs | 4 +---
public/views/slide.ejs | 4 +---
5 files changed, 18 insertions(+), 16 deletions(-)
create mode 100644 public/js/mathjax-config-extra.js
diff --git a/app.js b/app.js
index b78f94e1..88735854 100644
--- a/app.js
+++ b/app.js
@@ -118,22 +118,22 @@ app.use((req, res, next) => {
// https://helmetjs.github.io/docs/csp/
if (config.csp.enable) {
var cdnDirectives = {
- scriptSrc: ["https://cdnjs.cloudflare.com"],
- styleSrc: ["https://cdnjs.cloudflare.com", "https://fonts.googleapis.com"],
- fontSrc: ["https://cdnjs.cloudflare.com", "https://fonts.gstatic.com"]
+ scriptSrc: ['https://cdnjs.cloudflare.com', 'https://cdn.mathjax.org'],
+ styleSrc: ['https://cdnjs.cloudflare.com', 'https://fonts.googleapis.com'],
+ fontSrc: ['https://cdnjs.cloudflare.com', 'https://fonts.gstatic.com']
}
var directives = {}
for (var propertyName in config.csp.directives) {
- if(config.csp.directives.hasOwnProperty(propertyName)) {
+ if (config.csp.directives.hasOwnProperty(propertyName)) {
var directive = config.csp.directives[propertyName]
if (config.usecdn && !!cdnDirectives[propertyName]) {
directive = directive.concat(cdnDirectives[propertyName])
}
- directives[propertyName] = directive;
+ directives[propertyName] = directive
}
}
directives.scriptSrc.push(function (req, res) { return "'nonce-" + res.locals.nonce + "'" })
- if(config.csp.upgradeInsecureRequests === 'auto') {
+ if (config.csp.upgradeInsecureRequests === 'auto') {
directives.upgradeInsecureRequests = config.usessl === 'true'
} else {
directives.upgradeInsecureRequests = config.csp.upgradeInsecureRequests === 'true'
@@ -142,7 +142,7 @@ if (config.csp.enable) {
directives: directives
}))
} else {
- logger.info('Content-Security-Policy is disabled. This may be a security risk.');
+ logger.info('Content-Security-Policy is disabled. This may be a security risk.')
}
i18n.configure({
diff --git a/public/js/mathjax-config-extra.js b/public/js/mathjax-config-extra.js
new file mode 100644
index 00000000..54cee794
--- /dev/null
+++ b/public/js/mathjax-config-extra.js
@@ -0,0 +1,8 @@
+var MathJax = {
+ messageStyle: 'none',
+ skipStartupTypeset: true,
+ tex2jax: {
+ inlineMath: [['$', '$'], ['\\(', '\\)']],
+ processEscapes: true
+ }
+}
diff --git a/public/views/hackmd/foot.ejs b/public/views/hackmd/foot.ejs
index 6a1f3b99..8438dce2 100644
--- a/public/views/hackmd/foot.ejs
+++ b/public/views/hackmd/foot.ejs
@@ -1,6 +1,4 @@
-
+
<% if(useCDN) { %>
diff --git a/public/views/pretty.ejs b/public/views/pretty.ejs
index 80d2505c..b2988e39 100644
--- a/public/views/pretty.ejs
+++ b/public/views/pretty.ejs
@@ -72,9 +72,7 @@