Skip to content

Add SRI (Subresource Integrity) hash to CDN script tags #5165

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 12 commits into from
Jun 11, 2025
Merged
Prev Previous commit
Next Next commit
Clean up
  • Loading branch information
ddworken committed Jun 10, 2025
commit c08e20312f54cac2abb0aec1a6598c28c5129892
4 changes: 3 additions & 1 deletion tests/test_core/test_offline/test_offline.py
Original file line number Diff line number Diff line change
Expand Up @@ -9,8 +9,10 @@
import pytest

import plotly
from plotly.offline import get_plotlyjs
import plotly.io as pio
from plotly.io._utils import plotly_cdn_url
from plotly.io._html import _generate_sri_hash

packages_root = os.path.dirname(
os.path.dirname(os.path.dirname(os.path.dirname(os.path.realpath(plotly.__file__))))
Expand All @@ -37,7 +39,7 @@
<script type="text/javascript">\
window.PlotlyConfig = {MathJaxConfig: 'local'};</script>"""

cdn_script = '<script charset="utf-8" src="{cdn_url}"'.format(cdn_url=plotly_cdn_url())
cdn_script = '<script charset="utf-8" src="{cdn_url}" integrity="{js_hash}" crossorigin="anonymous"></script>'.format(cdn_url=plotly_cdn_url(http://github.com/%3Cspan%20class=%22x%20x-first%20x-last%22%3E), js_hash=_generate_sri_hash(get_plotlyjs()))

directory_script = '<script charset="utf-8" src="plotly.min.js"></script>'

Expand Down
5 changes: 1 addition & 4 deletions tests/test_io/test_html.py
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@

import pytest
import numpy as np
import re


import plotly.graph_objs as go
Expand Down Expand Up @@ -59,8 +60,6 @@ def test_cdn_includes_integrity_attribute(fig1):
assert 'crossorigin="anonymous"' in html_output

# Verify it's in the correct script tag
import re

cdn_pattern = re.compile(
r'<script[^>]*src="'
+ re.escape(plotly_cdn_url())
Expand All @@ -75,8 +74,6 @@ def test_cdn_integrity_hash_matches_bundled_content(fig1):
html_output = pio.to_html(fig1, include_plotlyjs="cdn")

# Extract the integrity hash from the HTML output
import re

integrity_pattern = re.compile(r'integrity="(sha256-[A-Za-z0-9+/=]+)"')
match = integrity_pattern.search(html_output)
assert match is not None, "Integrity attribute not found"
Expand Down