From 32252083fa2dbd8b8e2ef6ea7e429b034632f111 Mon Sep 17 00:00:00 2001 From: George Cushen Date: Sat, 30 Sep 2017 21:23:37 +0100 Subject: [PATCH] Improve versioning and SRI for dependencies - Parameterize JS and CSS versions (no longer hardcoded) - Highlight.js version moved from `config.toml` to `data/sri.toml` - SRI applied to Highlight.js --- data/sri.toml | 54 ++++++++++++++----- exampleSite/config.toml | 11 +--- .../content/post/writing-markdown-latex.md | 5 -- layouts/partials/footer.html | 27 ++++++---- layouts/partials/header.html | 19 +++---- 5 files changed, 68 insertions(+), 48 deletions(-) diff --git a/data/sri.toml b/data/sri.toml index d07ba1cf..6fed5fba 100644 --- a/data/sri.toml +++ b/data/sri.toml @@ -1,16 +1,42 @@ -# How to update an entry: -# -# echo -n "sha512-" && curl --silent "https://cdnjs.cloudflare.com/ajax/libs/mathjax/2.7.0/MathJax.js?config=TeX-AMS_CHTML" | openssl dgst -sha512 -binary | openssl enc -base64 -A +# Versioning and Subresource Integrity (SRI) for Academic's JavaScript and CSS dependencies -[js] - imagesLoaded = "sha512-umsR78NN0D23AzgoZ11K7raBD+R6hqKojyBZs1w8WvYlsI+QuKRGBx3LFCwhatzBunCjDuJpDHwxD13sLMbpRA==" - mathJax = "sha512-tOav5w1OjvsSJzePRtt2uQPFwBoHt1VZcUq8l8nm5284LEKE9FSJBQryzMBzHxY5P0zRdNqEcpLIRVYFNgu1jw==" - bootstrap = "sha512-iztkobsvnjKfAtTNdHkGVjAYTrrtlC7mGp/54c40wowO7LhURYl3gVzzcEqGl/qKXQltJ2HwMrdLcNUdo+N/RQ==" - isotope = "sha512-VDBOIlDbuC4VWxGJNmuFRQ0Li0SKkDpmGyuhAG5LTDLd/dJ/S0WMVxriR2Y+CyPL5gzjpN4f/6iqWVBJlht0tQ==" - jQuery = "sha512-3P8rXCuGJdNZOnUx/03c1jOTnMn3rP63nBip5gOP2qmUh5YAdVAvFZ1E+QLZZbC1rtMrQb+mah3AfYW11RUrWA==" - autotrack = "sha512-HUmooslVKj4m6OBu0OgzjXXr+QuFYy/k7eLI5jdeEy/F4RSgMn6XRWRGkFi5IFaFgy7uFTkegp3Z0XnJf3Jq+g==" +# When updating the version of an asset below, please also update the corresponding SRI. +# How to update the SRI for an entry: +# echo -n "sha512-" && curl --silent "https://cdnjs.cloudflare.com/ajax/libs/mathjax/2.7.0/MathJax.js?config=TeX-AMS_CHTML" | openssl dgst -sha512 -binary | openssl enc -base64 -A +# Or, the SRI for the appropriate asset can be copied from https://cdnjs.com/ . -[css] - bootstrap = "sha512-6MXa8B6uaO18Hid6blRMetEIoPqHf7Ux1tnyIQdpt9qI5OACx7C+O3IVTr98vwGnlcg0LOLa02i9Y1HpVhlfiw==" - academicons = "sha512-NThgw3XKQ1absAahW6to7Ey42uycrVvfNfyjqcFNgCmOCQ5AR4AO0SiXrN+8ZtYeappp56lk1WtvjVmEa+VR6A==" - fontAwesome = "sha512-SfTiTlX6kk+qitfevl/7LibUOeJWlt9rbyDn92a1DqWOw9vWG2MFoays0sgObmWazO5BQPiFucnnEAjpAB+/Sw==" +# JavaScript + +[js.jQuery] + version = "3.2.1" + sri = "sha512-3P8rXCuGJdNZOnUx/03c1jOTnMn3rP63nBip5gOP2qmUh5YAdVAvFZ1E+QLZZbC1rtMrQb+mah3AfYW11RUrWA==" +[js.bootstrap] + version = "3.3.7" + sri = "sha512-iztkobsvnjKfAtTNdHkGVjAYTrrtlC7mGp/54c40wowO7LhURYl3gVzzcEqGl/qKXQltJ2HwMrdLcNUdo+N/RQ==" +[js.highlight] + version = "9.12.0" + sri = "sha256-/BfiIkHlHoVihZdc6TFuj7MmJ0TWcWsMXkeDFwhi0zw=" +[js.mathJax] + version = "2.7.1" + sri = "sha512-tOav5w1OjvsSJzePRtt2uQPFwBoHt1VZcUq8l8nm5284LEKE9FSJBQryzMBzHxY5P0zRdNqEcpLIRVYFNgu1jw==" +[js.isotope] + version = "3.0.4" + sri = "sha512-VDBOIlDbuC4VWxGJNmuFRQ0Li0SKkDpmGyuhAG5LTDLd/dJ/S0WMVxriR2Y+CyPL5gzjpN4f/6iqWVBJlht0tQ==" +[js.imagesLoaded] + version = "4.1.3" + sri = "sha512-umsR78NN0D23AzgoZ11K7raBD+R6hqKojyBZs1w8WvYlsI+QuKRGBx3LFCwhatzBunCjDuJpDHwxD13sLMbpRA==" +[js.autotrack] + version = "2.4.1" + sri = "sha512-HUmooslVKj4m6OBu0OgzjXXr+QuFYy/k7eLI5jdeEy/F4RSgMn6XRWRGkFi5IFaFgy7uFTkegp3Z0XnJf3Jq+g==" + +# CSS + +[css.bootstrap] + version = "3.3.7" + sri = "sha512-6MXa8B6uaO18Hid6blRMetEIoPqHf7Ux1tnyIQdpt9qI5OACx7C+O3IVTr98vwGnlcg0LOLa02i9Y1HpVhlfiw==" +[css.fontAwesome] + version = "4.7.0" + sri = "sha512-SfTiTlX6kk+qitfevl/7LibUOeJWlt9rbyDn92a1DqWOw9vWG2MFoays0sgObmWazO5BQPiFucnnEAjpAB+/Sw==" +[css.academicons] + version = "1.8.1" + sri = "sha512-NThgw3XKQ1absAahW6to7Ey42uycrVvfNfyjqcFNgCmOCQ5AR4AO0SiXrN+8ZtYeappp56lk1WtvjVmEa+VR6A==" diff --git a/exampleSite/config.toml b/exampleSite/config.toml index eff7f34f..2be09582 100644 --- a/exampleSite/config.toml +++ b/exampleSite/config.toml @@ -82,21 +82,14 @@ defaultContentLanguageInSubdir = false # # Example: highlight_style = "github-gist" # - # highlight_version - # Choose the version of highlight.js you want. Setting this - # option in a page's preamble has no effect. - # - # Example: highlight_version = "9.9.0" - # - # For the list of supported languages, styles, and versions, see: + # For the list of supported languages and styles, see: # https://cdnjs.com/libraries/highlight.js/ # # For more info on the highlighting options, see: - # https://gcushen.github.io/hugo-academic-demo/post/writing-markdown-latex/#highlighting-options + # https://sourcethemes.com/academic/post/writing-markdown-latex/#highlighting-options highlight = true highlight_languages = [] # highlight_style = "github" - # highlight_version = "9.9.0" # Enable native social sharing buttons? sharing = true diff --git a/exampleSite/content/post/writing-markdown-latex.md b/exampleSite/content/post/writing-markdown-latex.md index 62aa0938..8d9cf46a 100644 --- a/exampleSite/content/post/writing-markdown-latex.md +++ b/exampleSite/content/post/writing-markdown-latex.md @@ -113,7 +113,6 @@ option | type | description | config.toml `highlight` | boolean | enable/disable highlighting | yes | yes `highlight_languages` | slice | choose additional languages | yes | yes `highlight_style` | string | choose a highlighting style | yes | no -`highlight_version` | string | choose the highlight.js version | yes | no #### Option `highlight` @@ -157,10 +156,6 @@ If you don't want to change the default style that ships with Academic but you d The `highlight_style` option is only recognized when set in `config.toml`. Setting `highlight_style` in your page's preamble has no effect. -#### Option `highlight_version` - -The `highlight_version` option, as the name implies, allows you to select the version of highlight.js you want to use. The default value is "9.9.0". The `highlight_version` option is only recognized when set in `config.toml`. Setting `highlight_version` in your page's preamble has no effect. - ## Twitter tweet To include a single tweet, pass the tweet’s ID from the tweet's URL as parameter to the shortcode: diff --git a/layouts/partials/footer.html b/layouts/partials/footer.html index 85a89822..1e46620d 100644 --- a/layouts/partials/footer.html +++ b/layouts/partials/footer.html @@ -1,13 +1,14 @@ + {{ $js := .Site.Data.sri.js }} {{ if not .Site.Params.disable_sri }} - {{ printf "" .Site.Data.sri.js.jQuery | safeHTML }} - {{ printf "" .Site.Data.sri.js.imagesLoaded | safeHTML }} - {{ printf "" .Site.Data.sri.js.bootstrap | safeHTML }} - {{ printf "" .Site.Data.sri.js.isotope | safeHTML }} + {{ printf "" $js.jQuery.version $js.jQuery.sri | safeHTML }} + {{ printf "" $js.imagesLoaded.version $js.imagesLoaded.sri | safeHTML }} + {{ printf "" $js.bootstrap.version $js.bootstrap.sri | safeHTML }} + {{ printf "" $js.isotope.version $js.isotope.sri | safeHTML }} {{ else }} - - - - + + + + {{ end }} {{ range .Site.Params.custom_js }} @@ -16,8 +17,12 @@ {{ if $.Scratch.Get "highlight_enabled" }} - {{ $v := .Site.Params.highlight_version | default "9.9.0" }} + {{ $v := $js.highlight.version }} + {{ if not .Site.Params.disable_sri }} + {{ printf "" $v $js.highlight.sri | safeHTML }} + {{ else }} + {{ end }} {{ range .Site.Params.highlight_languages }} @@ -40,9 +45,9 @@ MathJax.Hub.Config({ tex2jax: { inlineMath: [['$','$'], ['\\(','\\)']] } }); {{ if not .Site.Params.disable_sri }} - {{ printf "" .Site.Data.sri.js.mathJax | safeHTML }} + {{ printf "" $js.mathJax.version $js.mathJax.sri | safeHTML }} {{ else }} - + {{ end }} {{ end }} diff --git a/layouts/partials/header.html b/layouts/partials/header.html index 8be5bd35..ebe66c87 100644 --- a/layouts/partials/header.html +++ b/layouts/partials/header.html @@ -10,6 +10,7 @@ {{ with .Site.Params.name }}{{ end }} {{ with .Site.Params.role }}{{ end }} + {{ $sri := .Site.Data.sri }} {{/* Default to enabling highlighting, but allow the user to override it in .Params or .Site.Params. Use $.Scratch to store "highlight_enabled", so that we can read it again in footer.html. */}} {{ $.Scratch.Set "highlight_enabled" true }} @@ -19,7 +20,7 @@ {{ $.Scratch.Set "highlight_enabled" .Site.Params.highlight }} {{ end }} {{ if $.Scratch.Get "highlight_enabled" }} - {{ $v := .Site.Params.highlight_version | default "9.9.0" }} + {{ $v := $sri.js.highlight.version }} {{ with .Site.Params.highlight_style }} {{ else }} @@ -27,13 +28,13 @@ {{ end }} {{ end }} {{ if not .Site.Params.disable_sri }} - {{ printf "" .Site.Data.sri.css.bootstrap | safeHTML }} - {{ printf "" .Site.Data.sri.css.academicons | safeHTML }} - {{ printf "" .Site.Data.sri.css.fontAwesome | safeHTML }} + {{ printf "" $sri.css.bootstrap.version $sri.css.bootstrap.sri | safeHTML }} + {{ printf "" $sri.css.academicons.version $sri.css.academicons.sri | safeHTML }} + {{ printf "" $sri.css.fontAwesome.version $sri.css.fontAwesome.sri | safeHTML }} {{ else }} - - - + + + {{ end }} {{/* We cannot use SRI with Google Fonts because the CSS is dynamically generated according to the user agent */}} {{- partial "css/parse_theme.css" . -}} @@ -57,9 +58,9 @@ {{ if not .Site.Params.disable_sri }} - {{ printf "" .Site.Data.sri.js.autotrack | safeHTML }} + {{ printf "" $sri.js.autotrack.version $sri.js.autotrack.sri | safeHTML }} {{ else }} - + {{ end }} {{ end }}