c3js / c3js/c3

CSP inline-style error when hovering over the donut chart tooltip

Open
#2,907 1 comment 2 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
9.3k
Forks
1.4k
Avg merge
6d 16h
Merged PRs (30d)
1

Description

# CSP inline-style error when hovering over the donut chart tooltip

## Description
When hovering over the donut chart, the tooltip appears, but it triggers a CSP violation due to inline styles.

## Steps to Reproduce
1. Render a donut chart with tooltips enabled.
2. Ensure CSP settings prohibit `style-src 'self' 'nonce-123456' https:; ` styles.
3. Hover over the chart to display the tooltip.
4. Check the browser console for CSP errors.

## Expected Behavior
The tooltip should be displayed without causing CSP violations.

## Actual Behavior
The browser console reports a CSP violation related to `style="background-color: ..."`.

## Possible Cause
After reviewing the source code, I found that inline styles are applied to the tooltip using `style="background-color: ..."`, which is blocked by CSP.

## Suggested Fix
Consider using CSS classes or a safer approach to apply styles instead of inline styles.

## Environment
- **Library/Framework:** [Specify the version]
- **Browser:** [Specify browser & version]
- **CSP Settings:** `style-src 'self';` (or other restrictions in place)

Would appreciate any suggestions or fixes regarding this issue. Thanks!

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.