From ad756d938164b982fcb32451b027b198ce627316 Mon Sep 17 00:00:00 2001
From: "Ross A. Baker" <ross@rossabaker.com>
Date: Wed, 8 Jan 2025 13:40:23 -0500
Subject: [PATCH 1/4] Add no-referrer policy

---
 _includes/_head.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/_includes/_head.html b/_includes/_head.html
index ddf642b1..95d7fcd5 100644
--- a/_includes/_head.html
+++ b/_includes/_head.html
@@ -4,7 +4,7 @@
   <title>{{ site.name }} | {% if page.path contains '_event' %}{{ page.short_title }}{% else %}{{ page.title }}{% endif %}</title>
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <meta name="description" content="{{ site.description }}">
-
+  <meta name="referrer" content="no-referrer">
 
   <link rel="mask-icon" href="/img/favicon-safari.svg" color="#F51C2B">
   <link href="/img/favicon.png" rel="icon" type="image/x-icon">

From a72a14d06c14fa5efb5a6e74b3f1da674034eb3e Mon Sep 17 00:00:00 2001
From: "Ross A. Baker" <ross@rossabaker.com>
Date: Wed, 8 Jan 2025 13:59:54 -0500
Subject: [PATCH 2/4] Subresource integrity

---
 _includes/_head.html      | 2 +-
 _includes/_js-bottom.html | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/_includes/_head.html b/_includes/_head.html
index 95d7fcd5..de007832 100644
--- a/_includes/_head.html
+++ b/_includes/_head.html
@@ -10,7 +10,7 @@
   <link href="/img/favicon.png" rel="icon" type="image/x-icon">
 
   <!-- Custom CSS -->
-  <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.3.1/styles/monokai.min.css">
+  <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.3.1/styles/monokai.min.css" crossorigin="anonymous" integrity="sha384-88Jvj9Q2LiBDwL7w3yciRTcH5q2zzvMFYIm4xX9/evqxJsxA33Xk9XYKcvUlPITo">
   <link rel="stylesheet" href="{{ '/css/main.css' | relative_url }}">
 
   <link rel="alternate" type="application/rss+xml" title="Blog articles" href="{% link blog/feed.rss %}" />
diff --git a/_includes/_js-bottom.html b/_includes/_js-bottom.html
index 42e63297..c0fe83d4 100644
--- a/_includes/_js-bottom.html
+++ b/_includes/_js-bottom.html
@@ -1,5 +1,5 @@
 <script type="text/javascript" src="{{ '/js/functions.js' | relative_url }}"></script>
-<script src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.3.1/highlight.min.js"></script>
-<script src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.3.1/languages/scala.min.js"></script>
+<script src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.3.1/highlight.min.js" crossorigin="anonymous" integrity="sha384-zDX/4RkDnpVxZkjJjxdzDsT1Kk2XThh7u47fXdgZ1W8AMjb//F4ZK4G4y7oNVHM1"></script>
+<script src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.3.1/languages/scala.min.js" crossorigin="anonymous" integrity="sha384-3GmPRxZT/qivuIKFrF0btQk8Z2jeNUlpWOyZBiRlf1Yi2CD+EWISY5mi+2yflNz4"></script>
 <script>hljs.highlightAll();</script>
-<script src="https://kit.fontawesome.com/a7055d991d.js" crossorigin="anonymous"></script>
+<script src="https://kit.fontawesome.com/a7055d991d.js" crossorigin="anonymous" integrity="sha384-X3bthPf99rHsI5P+JvfCFDjJ25zSlFjBMRD9IKXGGUN2/dXFn9HXcpAwU8141qKG></script>

From b6a59398983f099abba3f282130db58828e2587f Mon Sep 17 00:00:00 2001
From: "Ross A. Baker" <ross@rossabaker.com>
Date: Wed, 8 Jan 2025 15:34:46 -0500
Subject: [PATCH 3/4] Content-Security-Policy

---
 _includes/_head.html | 1 +
 1 file changed, 1 insertion(+)

diff --git a/_includes/_head.html b/_includes/_head.html
index de007832..1c6a8304 100644
--- a/_includes/_head.html
+++ b/_includes/_head.html
@@ -4,6 +4,7 @@
   <title>{{ site.name }} | {% if page.path contains '_event' %}{{ page.short_title }}{% else %}{{ page.title }}{% endif %}</title>
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <meta name="description" content="{{ site.description }}">
+  <meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'self' cdnjs.cloudflare.com 'unsafe-inline'; style-src 'self' cdnjs.cloudflare.com 'unsafe-inline'; font-src fonts.gstatic.com cdnjs.cloudflare.com; img-src 'self' img.shields.io; frame-src www.google.com; upgrade-insecure-requests">
   <meta name="referrer" content="no-referrer">
 
   <link rel="mask-icon" href="/img/favicon-safari.svg" color="#F51C2B">

From 28bc63676898f39688576f00bcbc9074038dae6e Mon Sep 17 00:00:00 2001
From: "Ross A. Baker" <ross@rossabaker.com>
Date: Wed, 8 Jan 2025 15:43:12 -0500
Subject: [PATCH 4/4] Add integrity to mathjax

---
 _includes/_head.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/_includes/_head.html b/_includes/_head.html
index 1c6a8304..722344ef 100644
--- a/_includes/_head.html
+++ b/_includes/_head.html
@@ -25,7 +25,7 @@
     };
   </script>
   <script type="text/javascript" id="MathJax-script" async
-    src="https://cdn.jsdelivr.net/npm/mathjax@3/es5/tex-mml-chtml.js">
+    src="https://cdnjs.cloudflare.com/ajax/libs/mathjax/3.2.2/es5/tex-mml-chtml.js" crossorigin="anonymous" integrity="sha384-Wuix6BuhrWbjDBs24bXrjf4ZQ5aFeFWBuKkFekO2t8xFU0iNaLQfp2K6/1Nxveei">
   </script>
   {% endif %}
 </head>