Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Add SRI (Subresource Integrity) hash to CDN script tags#5165

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
gvwilson merged 12 commits intoplotly:mainfromddworken:add-sri-hash-to-cdn
Jun 11, 2025

Conversation

ddworken
Copy link
Contributor

Wheninclude_plotlyjs='cdn' is set, the generated HTML now includes an integrity attribute with a SHA256 hash of the bundled plotly.js content. This provides enhanced security by ensuring the browser verifies the integrity of the CDN-served file.

  • Added _generate_sri_hash() function to create SHA256 hashes
  • Modified CDN script tag generation to include integrity and crossorigin attributes
  • Added comprehensive tests to verify SRI functionality
  • Updated existing tests to account for new script tag format

Code PR

  • I have read through thecontributing notes and understand the structure of the package. In particular, if my PR modifies code ofplotly.graph_objects, my modifications concern thecodegen files and not generated files.
  • I have added tests (if submitting a new feature or correcting a bug) or
    modified existing tests.
  • I have added a CHANGELOG entry if fixing/changing/adding anything substantial.
  • For a new feature or a change in behaviour, I have updated the relevant docstrings in the code to describe the feature or behaviour (please see the doc checklist as well).

ddworkenand others added7 commitsMay 2, 2025 11:27
When include_plotlyjs='cdn', the generated HTML now includes an integrityattribute with a SHA256 hash of the bundled plotly.js content. This providesenhanced security by ensuring the browser verifies the integrity of theCDN-served file.- Added _generate_sri_hash() function to create SHA256 hashes- Modified CDN script tag generation to include integrity and crossorigin attributes- Added comprehensive tests to verify SRI functionality- Updated existing tests to account for new script tag format
… attributesUpdate test template to match actual output which now includes SRI integrityattribute and crossorigin attribute for CDN script tags.🤖 Generated with [Claude Code](https://claude.ai/code)Co-Authored-By: Claude <noreply@anthropic.com>
Adjust whitespace after script tag to match actual output and fix CI failures.🤖 Generated with [Claude Code](https://claude.ai/code)Co-Authored-By: Claude <noreply@anthropic.com>
- Fix formatting in test_html.py- Fix formatting in test_offline.py- Fix formatting in _html.py🤖 Generated with [Claude Code](https://claude.ai/code)Co-Authored-By: Claude <noreply@anthropic.com>
Removed the claude settings entry from .gitignore🤖 Generated with [Claude Code](https://claude.ai/code)Co-Authored-By: Claude <noreply@anthropic.com>
@ddworkenddworken marked this pull request as ready for reviewMay 2, 2025 20:46
@ddworken
Copy link
ContributorAuthor

@emilykl is this something you'd be able to help review? If you have any thoughts on alternate approaches (e.g. adding a new optioncdn_with_sri) I'm also happy to adopt that. :)

@gvwilsongvwilson added featuresomething new P2considered for next cycle communitycommunity contribution labelsMay 8, 2025
@gvwilson
Copy link
Contributor

@marthacryan@T4rk1n well beyond what I understand about safety on the web - please have a look at some point and comment. thanks -@gvwilson

@ddworken
Copy link
ContributorAuthor

Thanks! Let me know if there is anything I can help explain about this. The key bit is this helps ensure that the generated HTML can include JS from the CDN while defending against security risks of the CDN getting compromised. Essentially the best of both worlds: The small file size of thecdn option, and the security of the offline option.

@gvwilsongvwilson added P1needed for current cycle and removed P2considered for next cycle labelsMay 14, 2025
@ddworken
Copy link
ContributorAuthor

@T4rk1n would you be willing to take another look at this?

@ddworken
Copy link
ContributorAuthor

Gentle ping :) Let me know if there is anything I can do to help get this landed.

@ddworken
Copy link
ContributorAuthor

Hello! Are you willing to take another look at this PR?

@gvwilson
Copy link
Contributor

@ddworken apologies for the delay - we're all tied up withhttps://go.plotly.com/smarter-faster-data-apps-bi at the moment but I hope to get eyes on this some time soon

ddworken reacted with thumbs up emoji

@gvwilsongvwilson requested a review fromarchmojJune 10, 2025 18:12
@gvwilsongvwilson merged commit1ec864b intoplotly:mainJun 11, 2025
8 checks passed
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment
Reviewers

@camdecostercamdecostercamdecoster left review comments

@T4rk1nT4rk1nT4rk1n approved these changes

@marthacryanmarthacryanAwaiting requested review from marthacryan

@archmojarchmojAwaiting requested review from archmoj

Labels
communitycommunity contributionfeaturesomething newP1needed for current cycle
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

5 participants
@ddworken@gvwilson@camdecoster@T4rk1n@marthacryan
[8]ページ先頭
©2009-2025 Movatter.jp