Kozea / Kozea/pygal

Consider adding CSP support - nonce attr for inline style/script elements

Open
#489 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
2.8k
Forks
419
PR merge metrics
No merged PRs in 30d

Description

It would be great when calling rendering functions to be able to use nonce value string, ie. keyword nonce=... - which value then get used as nonce attribute in and <style> tags in the rendered svg.

The embedding will be then feasible in website using more strict CSP policy.

Possibly the nonce attr. might be useful in the <svg> tag as well...

Contributor guide

Open the contributing guide

Research direction

Start by locating pygal's rendering functions and the code that emits inline , <style>, and <svg> elements. Trace how rendering keyword arguments are handled, then verify that a supplied nonce is emitted on the requested elements and that existing rendering behavior remains unchanged.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
computer-graphics, security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.