Skip to content

Conversation

@juba
Copy link
Contributor

@juba juba commented Sep 29, 2021

What problem did you solve?

PR #771 replaced unsafe-eval with unsafe-inline in script-src CSP to make flextable work, but disabling unsafe-eval broke some of my package code which uses htmlwidgets::JS.

I think that putting both unsafe-eval and unsafe-inline in CSP allows to make both code work :

script-src https: data: filesystem: 'unsafe-inline' 'unsafe-eval';

(If you do not have screenshot) How can I check this pull request?

The following code should produce a line plot with a red "Hello, world!" text.

remotes::install_github("juba/obsplot")
library(obsplot)
library(htmlwidgets)
obsplot(aapl) |>
  mark_line(x = "Date", y = "Close") |>
  mark_function(JS("() => svg`<text x=20% y=20% fill=red>Hello, world!</text>`"))

Many thanks !

@renkun-ken
Copy link
Member

Thanks for reporting and fixing it. I'm no expert on CSP, but it looks good according to https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src.

Copy link
Member

@renkun-ken renkun-ken left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@renkun-ken renkun-ken merged commit 981519e into REditorSupport:master Sep 29, 2021
@juba juba deleted the patch-1 branch September 30, 2021 07:42
ElianHugh pushed a commit to ElianHugh/vscode-R that referenced this pull request May 12, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants