Consider adding CSP support - nonce attr for inline style/script elements
Open
- Dominant language
- Python
- Stars
- 2.8k
- Forks
- 419
- PR merge metrics
- No merged PRs in 30d
Description
It would be great when calling rendering functions to be able to use nonce value string, ie. keyword nonce=... - which value then get used as nonce attribute in and <style> tags in the rendered svg.
The embedding will be then feasible in website using more strict CSP policy.
Possibly the nonce attr. might be useful in the <svg> tag as well...
Contributor guide
Research direction
Start by locating pygal's rendering functions and the code that emits inline , <style>, and <svg> elements. Trace how rendering keyword arguments are handled, then verify that a supplied nonce is emitted on the requested elements and that existing rendering behavior remains unchanged.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- computer-graphics, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100