fix: resolve CDN redirect failure by using loose security policy and CSP whitelist (#96)

xihale · web-flow · commit 3e9a46fd1aaa · 2026-01-25T11:06:57.000+08:00
diff --git a/content/post/2025-07-19-zine-migration.smd b/content/post/2025-07-19-zine-migration.smd
@@ -171,21 +171,15 @@ Zine 布局有几个关键特性：
 <ctx :if="$page.custom.getOr('math', false)">
   <link
     href="https://cdnjs.webstatic.cn/ajax/libs/KaTeX/0.16.9/katex.min.css"
-    integrity="sha512-fHwaWebuwA7NSF5Qg/af4UeDx9XqUpYpOGgubo3yWu+b2IQR4UeQwbb42Ti7gVAjNtVoI/I9TEoYeu9omwcC6g=="
-    crossorigin="anonymous"
     rel="stylesheet"
   />
   <script
     defer
     src="https://cdnjs.webstatic.cn/ajax/libs/KaTeX/0.16.9/katex.min.js"
-    integrity="sha512-LQNxIMR5rXv7o+b1l8+N1EZMfhG7iFZ9HhnbJkTp4zjNr5Wvst75AqUeFDxeRUa7l5vEDyUiAip//r+EFLLCyA=="
-    crossorigin="anonymous"
   ></script>
   <script
     defer
     src="https://cdnjs.webstatic.cn/ajax/libs/KaTeX/0.16.9/contrib/auto-render.min.js"
-    integrity="sha512-iWiuBS5nt6r60fCz26Nd0Zqe0nbk1ZTIQbl3Kv7kYsX+yKMUFHzjaH2+AnM6vp2Xs+gNmaBAVWJjSmuPw76Efg=="
-    crossorigin="anonymous"
     onload="renderMathInElement(document.body);"
   ></script>
 </ctx>
diff --git a/layouts/post.shtml b/layouts/post.shtml
@@ -1,12 +1,10 @@
 <extend template="base.shtml">
 <head id="head">
   <ctx :if="$page.custom.getOr('math', false)">
-    <link href="https://cdnjs.webstatic.cn/ajax/libs/KaTeX/0.16.9/katex.min.css" integrity="sha512-fHwaWebuwA7NSF5Qg/af4UeDx9XqUpYpOGgubo3yWu+b2IQR4UeQwbb42Ti7gVAjNtVoI/I9TEoYeu9omwcC6g==" crossorigin="anonymous" rel="stylesheet">
+    <link href="https://cdnjs.webstatic.cn/ajax/libs/KaTeX/0.16.9/katex.min.css" rel="stylesheet">
     <script
       defer
       src="https://cdnjs.webstatic.cn/ajax/libs/KaTeX/0.16.9/katex.min.js"
-      integrity="sha512-LQNxIMR5rXv7o+b1l8+N1EZMfhG7iFZ9HhnbJkTp4zjNr5Wvst75AqUeFDxeRUa7l5vEDyUiAip//r+EFLLCyA=="
-      crossorigin="anonymous"
     ></script>
     <script>
       function renderKaTeX() {
@@ -20,10 +18,10 @@
         });
       }
     </script>
-    <script defer src="https://cdnjs.webstatic.cn/ajax/libs/KaTeX/0.16.9/contrib/auto-render.min.js" integrity="sha512-iWiuBS5nt6r60fCz26Nd0Zqe0nbk1ZTIQbl3Kv7kYsX+yKMUFHzjaH2+AnM6vp2Xs+gNmaBAVWJjSmuPw76Efg==" crossorigin="anonymous" onload="renderKaTeX()"></script>
+    <script defer src="https://cdnjs.webstatic.cn/ajax/libs/KaTeX/0.16.9/contrib/auto-render.min.js" onload="renderKaTeX()"></script>
   </ctx>
   <ctx :if="$page.custom.getOr('mermaid', false)">
-    <script defer src="https://cdnjs.webstatic.cn/ajax/libs/mermaid/11.12.0/mermaid.min.js" integrity="sha512-5TKaYvhenABhlGIKSxAWLFJBZCSQw7HTV7aL1dJcBokM/+3PNtfgJFlv8E6Us/B1VMlQ4u8sPzjudL9TEQ06ww==" crossorigin="anonymous" onload="mermaid.initialize({theme: window.matchMedia('(prefers-color-scheme: dark)').matches ? 'dark' : 'default'}); mermaid.run();"></script>
+    <script defer src="https://cdnjs.webstatic.cn/ajax/libs/mermaid/11.12.0/mermaid.min.js" onload="mermaid.initialize({theme: window.matchMedia('(prefers-color-scheme: dark)').matches ? 'dark' : 'default'}); mermaid.run();"></script>
   </ctx>
 </head>
 <body id="body">
diff --git a/layouts/templates/base.shtml b/layouts/templates/base.shtml
@@ -3,6 +3,7 @@
   <head id="head">
     <meta charset="utf-8">
     <meta name="viewport" content="initial-scale=1">
+    <meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.webstatic.cn https://cdnjs.cloudflare.com https://hm.baidu.com; style-src 'self' 'unsafe-inline' https://cdnjs.webstatic.cn https://cdnjs.cloudflare.com; img-src 'self' data: https:; connect-src 'self' https://en.liujiacai.net https://cdnjs.cloudflare.com https://hm.baidu.com;">
     <meta name="algolia-site-verification" content="12324D77A7D77468">
     <title :text="$page.title"></title>
     <link type="text/css" rel="stylesheet" href="$site.asset('style.css').link()">
