fixup! feat: add pelican-render-math plugin

Author: Swiftb0y

netlify.toml

@@ -49,4 +49,4 @@
  for = "/news/*"
  [headers.values]
    # Additionally allow YouTube/Discourse frames and scripts and MathJax
-    Content-Security-Policy = "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'sha256-UPkidoMErzWw1gW/eY4LhAi9ZkPch3PP31d6KQoJ6Yc='  'sha256-G40wI6OaLZXCtrb02xUq1H1kEVWjstzoQ0FXKwsWxPw='	 'sha256-NoYDhgfdmQGg59XPik/7lIF57F0zlpWNHiB+uKc1Lc8=' https://mixxx.discourse.group/javascripts/embed.js *.discourse-cdn.com cdn.jsdelivr.net; frame-src 'self' https://www.youtube-nocookie.com https://mixxx.discourse.group ; img-src 'self' https://i.ytimg.com ; connect-src 'self' https://mixxx.discourse.group https://*.discourse-cdn.com"
+    Content-Security-Policy = "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'sha256-UPkidoMErzWw1gW/eY4LhAi9ZkPch3PP31d6KQoJ6Yc='  'sha256-G40wI6OaLZXCtrb02xUq1H1kEVWjstzoQ0FXKwsWxPw='	'sha256-1CldwzdEg2k1wTmf7s5RWVd7NMXI/7nxxjJM2C4DqII=' https://mixxx.discourse.group/javascripts/embed.js *.discourse-cdn.com; frame-src 'self' https://www.youtube-nocookie.com https://mixxx.discourse.group ; img-src 'self' https://i.ytimg.com ; connect-src 'self' https://mixxx.discourse.group https://*.discourse-cdn.com"

theme/templates/article.html

@@ -68,9 +68,10 @@ <h4>{% trans %}Comments{% endtrans %}</h4>
 {% block extra_head %}
 {% if article.comments and article.comments in ("true", "yes") %}
 <script src="{{ SITEURL }}/theme/js/discourse.js"></script>
+{% endif %}
 {% if article.math and article.math in ("true", "yes") %}
 {# Note that we don't insert any mathjax config. If you want to configure mathjax, see https://docs.mathjax.org/en/latest/web/configuration.html#configuring-mathjax #}
-<script id="MathJax-script" type="text/javascript" src="https://cdn.jsdelivr.net/npm/mathjax@3/es5/tex-svg.js"></script>
-{% endif %}
+{# pinning the latest MathJax and using Subresource integrity (since that allows us to avoid whitelisting all of jsdelivr in the CSP) #}
+<script id="MathJax-script" type="text/javascript" integrity="sha256-1CldwzdEg2k1wTmf7s5RWVd7NMXI/7nxxjJM2C4DqII=" crossorigin="anonymous" src="https://cdn.jsdelivr.net/npm/mathjax@3.2.2/es5/tex-svg.js"></script>
 {% endif %}
 {% endblock %}