From 8d8cddfdb237bc56912616ba1a650b10cc92f202 Mon Sep 17 00:00:00 2001
From: Thom Wiggers <thomwiggers@users.noreply.github.com>
Date: Sun, 21 Oct 2018 21:32:44 +0200
Subject: [PATCH] Load MathJax config without eval() (#735)

This allows stricter content security policies for
`Content-Security-Policy` header.
---
 assets/js/mathjax-config.js  |  6 ++++++
 layouts/partials/footer.html | 11 +++--------
 2 files changed, 9 insertions(+), 8 deletions(-)
 create mode 100644 assets/js/mathjax-config.js

diff --git a/assets/js/mathjax-config.js b/assets/js/mathjax-config.js
new file mode 100644
index 00000000..5a0772a6
--- /dev/null
+++ b/assets/js/mathjax-config.js
@@ -0,0 +1,6 @@
+window.MathJax = {
+  CommonHTML: { linebreaks: { automatic: true } },
+  tex2jax: { inlineMath: [ ['$', '$'], ['\\(','\\)'] ], displayMath: [ ['$$','$$'], ['\\[', '\\]'] ], processEscapes: false },
+  TeX: { noUndefined: { attributes: { mathcolor: 'red', mathbackground: '#FFEEEE', mathsize: '90%' } } },
+  messageStyle: 'none'
+};
diff --git a/layouts/partials/footer.html b/layouts/partials/footer.html
index 13743437..e7cdecfc 100644
--- a/layouts/partials/footer.html
+++ b/layouts/partials/footer.html
@@ -2,14 +2,9 @@
 
     {{/* Config LaTeX math rendering. */}}
     {{ if or .Params.math .Site.Params.math }}
-    <script type="text/x-mathjax-config">
-      MathJax.Hub.Config({
-        CommonHTML: { linebreaks: { automatic: true } },
-        tex2jax: { inlineMath: [ ['$', '$'], ['\\(','\\)'] ], displayMath: [ ['$$','$$'], ['\\[', '\\]'] ], processEscapes: false },
-        TeX: { noUndefined: { attributes: { mathcolor: 'red', mathbackground: '#FFEEEE', mathsize: '90%' } } },
-        messageStyle: 'none'
-      });
-    </script>
+    {{ $mathjax_config := resources.Get "js/mathjax-config.js" }}
+    {{ $secureJS := $mathjax_config | resources.Fingerprint "sha512" }}
+    <script src="{{ $secureJS.Permalink }}" integrity="{{ $secureJS.Data.Integrity }}"></script>
     {{ end }}
 
     {{/* Attempt to load local vendor JS, otherwise load from CDN. */}}