Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix incompatibility with strict/safe CSP #35

Closed
tdelmas opened this issue Feb 16, 2020 · 1 comment
Closed

Fix incompatibility with strict/safe CSP #35

tdelmas opened this issue Feb 16, 2020 · 1 comment

Comments

@tdelmas
Copy link

tdelmas commented Feb 16, 2020

https://github.com/d3/d3-fetch/blob/master/src/dsv.js use csvParse and tsvParse from "d3-dsv"

As explained in d3/d3-dsv#65 by @mbostock :

I recommend using parseRows as suggested in the text you pasted from the README and a row function to turn the array of field values into an object.

Using csvParse or tsvParse make it incompatible with CSP without unsafe-eval.

It impact for example plotly/plotly.js#897 (which use the old version of d3 "3.5.17" so "d3-request" and not this package, but "d3-request" has the exact same problem. I didn't opened an issue there as its status is "This module is deprecated as of D3 5.0; please use d3-fetch instead.")

Or is there another API from this package that can be used to avoid that problem?

@mbostock
Copy link
Member

Use d3.text or use fetch directly.

d3.csvParseRows(await d3.text("path/to/file.csv"))
fetch("path/to/file.csv")
  .then(response => response.text())
  .then(text => d3.csvParseRows(text))

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

No branches or pull requests

2 participants