Skip to content

Conversation

@carlosrobertoprogramador

What kind of change does this PR introduce? (check one with "x")

  • [ X ] Bugfix
  • Feature
  • Code style update (formatting, local variables)
  • Refactoring (no functional changes, no api changes)
  • Build related changes
  • CI related changes
  • Other... Please describe:

What is the current behavior? (You can also link to an open issue here)
The tooltip in the area chart relies on inline style bindings ([style.opacity], [style.cursor]) that cause issues in environments enforcing strict Content Security Policy (CSP).

What is the new behavior?
What is the new behavior?
The tooltip has been refactored to use CSS classes and Angular bindings that properly support enforcement. This fix ensures correct rendering of the tooltip both in CSP-restricted environments with nonce and in environments without CSP.

Does this PR introduce a breaking change? (check one with "x")

  • Yes
  • [ X ] No

If this PR contains a breaking change, please describe the impact and migration path for existing applications: ...

Other information:
Tested in browsers with strict CSP headers requiring nonce and without CSP; tooltip functions correctly in both scenarios without style or security violations.

@bufke
Copy link

bufke commented Jul 23, 2025

I applied this to a project and it fixes the CSP issue for me. Would love to see this merged.

BTW there is another unsafe inline style at

style="fill: rgb(255, 0, 0); opacity: 0; cursor: 'auto';"
these really don't need to be inline. The same type of fix would apply here. This package ALMOST works with strict CSP.

Basically one should never use style="something"

Now I don't use bubble charts. But upon request, I would be happy to submit a PR and test it just for the betterment of the project.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants