Conversation
| ax=self.cax, label="log", position=(0.5, 0.98), va="top", **args | ||
| if not hide_log_buttons: | ||
| args = {"transform": self.ax.transAxes, "ha": "right", "va": "top"} | ||
| self._logx_button = CanvasToggleButton( |
There was a problem hiding this comment.
Are the attributes on self optional now? How does the rest of the class cope with this?
There was a problem hiding this comment.
The diff is misleading, the self._logx_button are set to None further up.
| // Function to update SVG | ||
| function updateSVG() { | ||
| const svgData = new TextDecoder().decode(model.get('svg_data')); | ||
| svgContainer.innerHTML = svgData; |
There was a problem hiding this comment.
You are sending unvalidated HTML to the DOM here. The same in HoverButtonWidget. But I guess this is well isolated enough that it doesn't receive arbitrary inputs?
There was a problem hiding this comment.
I guess I am? Suggestions for change?
There was a problem hiding this comment.
To be completely safe, I think you would have to do a bunch of validation manually or get a 3rd party library. But using an image element like this should help:
<img src="data:image/svg+xml,{image-data}">where {image-data} is the SVG source as a base64 encoded string.
Generally, this widget only receives inputs from Python, i.e., a process with system access. Python can do much worse than inject some malicious svg. So this might not be a concern.
2 participants
Sometimes, when we have many subplots, the log buttons on every axes get in the way (and they also slow things down when the mouse enters/leaves the axes).
We add an option to disable them.