Metriche repository
- Star
- (12.263 stelle)
- Metriche merge PR
- (Metriche PR in attesa)
Descrizione
In this piece of code a data URL is used:
This requires applications using Content Security Policy directives with full restrictions to allow data: as described here and here.
https://security.stackexchange.com/questions/94993/is-including-the-data-scheme-in-your-content-security-policy-safe discusses if
data: is safe or not. One answer suggests it has never been proven to be unsafe, even though multiple articles mentions it is.
To be better safe than sorry many applications forbid data: and only allow the 'self' as the CSP source.
Would it be possible to put the SVG in an external file and instead bundle it that way? I.e. as a real URL to the .svg. It's also nice in the sense that users can actually open the SVG in the src in this repo to see what it looks like 😄