You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I'd like to use victory in a chrome extension, where the default Content Security Policy disallows the use of eval (which is at the core of reduce-css-calc's functionality). Now, I can relax this manually, but eval is a notorious XSS concern, and it's much safer to disallow it.
Unfortunately, calc() literals are not allowed as svg properties (e.g. dx, dy); they are only allowed in CSS. And so without eval, lots of html syntax errors are raised, and e.g. the tick labels don't get placed correctly
Is there a way that you could remove the need for reduce-css-calc?
The text was updated successfully, but these errors were encountered:
+1, we've had to relax our CSP due to this :( Wonder if it could at least be made optional (and I guess accept a performance hit? or is the use more fundamental than that?)
I'd like to use victory in a chrome extension, where the default Content Security Policy disallows the use of
eval
(which is at the core of reduce-css-calc's functionality). Now, I can relax this manually, but eval is a notorious XSS concern, and it's much safer to disallow it.Unfortunately,
calc()
literals are not allowed as svg properties (e.g. dx, dy); they are only allowed in CSS. And so without eval, lots of html syntax errors are raised, and e.g. the tick labels don't get placed correctlyIs there a way that you could remove the need for reduce-css-calc?
The text was updated successfully, but these errors were encountered: