Content-Security-Policy prevents MathJax from loading

[emichael]

Unfortunately, sites that set Content-Security-Policy in their headers prevent MathJax from loading. This is unfortunate, but I'm not sure what to do about it since (AFAIK) MathJax relies on being able to put scripts in the DOM and having them be loaded by the browser.

At the very least, we should make sure that MathJax.Hub is defined in retexChecker.js before trying to Queue the typesetting to avoid throwing a million exceptions.

[emichael]

It looks like I'm going to have to change the way MathJax.Ajax does loading to make sure all of the javascript ends up in the content_script context instead of the page context.

[emichael]

Nope, changing MathJax.Ajax won't fix things it looks like. (Unless I can circumvent the CSP entirely in the content_script environment by setting it myself.)

By simply loading MathJax from the extension library version with chrome.extension.getURL, I was able to circumvent most of the CSP (all of the necessary files were actually loading). The problem is now with EVAL in MathJax.js:265. eval.call is not allowed, and neither is injection via an inline script.

[emichael]

Even better idea! Use chrome.webRequest to modify the CSP to allow MathJax's CDN (and possibly inline scripts if necessary).
This should work......