Revisit Plotly.js compatibility with strict CSP
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 18.3k
- Forks
- 2k
- Avg merge
- 2d 12h
- Merged PRs (30d)
- 28
Description
https://github.com/plotly/plotly.js/pull/7109 was added in to make Plotly.js work better in strict CSP environments (specifically, ones which disallow inline CSS); however, it seems some of that work was broken by the migration to ESBuild.
For example, we no longer produce a separate plotly.css file (see recent comments on that PR).
@camdecoster recently added #7527 which makes it easier to test different CSPs in the devtools.
There's at least one obvious issue when inline styles are disallowed, which is that the modebar button styling is completely broken:
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing PR #7109 and its recent comments, then inspect the ESBuild migration and issue #7527's CSP testing setup. Reproduce the modebar button styling failure with inline CSS disallowed and check whether a separate plotly.css file is produced. Done means strict CSP environments retain working modebar styling and the relevant build output is verified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- data-visualization, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100