Merge pull request #863 from vega/next

README.md

@@ -178,7 +178,7 @@ var opt = {
 | `mode`        | String        | If specified, tells Vega-Embed to parse the spec as `vega` or `vega-lite`. Vega-Embed will parse the [`$schema` url](https://github.com/vega/schema) if the mode is not specified. Vega-Embed will default to `vega` if neither `mode`, nor `$schema` are specified. |
 | `config`      | String / Object | _String_ : A URL string from which to load a [Vega](https://vega.github.io/vega/docs/config/)/[Vega-Lite](https://vega.github.io/vega-lite/docs/config.html) or [Vega-Lite](https://vega.github.io/vega-lite/docs/config.html) configuration file. This URL will be subject to standard browser security restrictions. Typically this URL will point to a file on the same host and port number as the web page itself. <br> _Object_ : A Vega/Vega-Lite configuration as a parsed JSON object to override the default configuration options. |
 | `theme`       | String        | If specified, tells Vega-Embed use the theme from [Vega Themes](https://github.com/vega/vega-themes). **Experimental: we may update themes with minor version updates of Vega-Embed.** |
-| `defaultStyle` | Boolean or String | If set to `true` (default), the embed actions are shown in a menu. Set to `false` to use simple links. Provide a string to set the style sheet. |
+| `defaultStyle` | Boolean or String | If set to `true` (default), the embed actions are shown in a menu. Set to `false` to use simple links. Provide a string to set the style sheet (not supported in usermeta). |
 | `bind`        | String or Element | The element that should contain any input elements bound to signals. |
 | `renderer`    | String        | The renderer to use for the view. One of `"canvas"` (default) or `"svg"`. See [Vega docs](https://vega.github.io/vega/docs/api/view/#view_renderer) for details. May be a custom value if passing your own `viewClass` option. |
 | `logLevel`    | Level         | Sets the current log level. See [Vega docs](https://vega.github.io/vega/docs/api/view/#view_logLevel) for details. |

package.json

@@ -54,7 +54,7 @@
     "jest-canvas-mock": "^2.3.1",
     "patch-package": "^6.4.7",
     "postinstall-postinstall": "^2.1.0",
-    "rollup": "2.67.1",
+    "rollup": "2.67.2",
     "rollup-plugin-bundle-size": "^1.0.3",
     "rollup-plugin-terser": "^7.0.2",
     "rollup-plugin-ts": "^2.0.5",

src/embed.ts

@@ -132,6 +132,9 @@ export interface Result {
   /** The compiled and patched Vega specification. */
   vgSpec: VgSpec;
 
+  /** The Vega-Embed options. */
+  embedOptions: EmbedOptions;
+
   /** Removes references to unwanted behaviors and memory leaks. Calls Vega's `view.finalize`.  */
   finalize: () => void;
 }
@@ -206,7 +209,12 @@ function createLoader(opts?: Loader | LoaderOptions) {
 }
 
 function embedOptionsFromUsermeta(parsedSpec: VisualizationSpec) {
-  return (parsedSpec.usermeta as any)?.embedOptions ?? {};
+  const opts = (parsedSpec.usermeta as any)?.embedOptions ?? {};
+  if (isString(opts.defaultStyle)) {
+    // we don't allow styles set via usermeta since it would allow injection of logic (we set the style via innerHTML)
+    opts.defaultStyle = false;
+  }
+  return opts;
 }
 
 /**
@@ -232,14 +240,15 @@ export default async function embed(
     parsedSpec = spec;
   }
 
-  const usermetaLoader = embedOptionsFromUsermeta(parsedSpec).loader;
+  const loadedEmbedOptions = embedOptionsFromUsermeta(parsedSpec);
+  const usermetaLoader = loadedEmbedOptions.loader;
 
   // either create the loader for the first time or create a new loader if the spec has new loader options
   if (!loader || usermetaLoader) {
     loader = createLoader(opts.loader ?? usermetaLoader);
   }
 
-  const usermetaOpts = await loadOpts(embedOptionsFromUsermeta(parsedSpec), loader);
+  const usermetaOpts = await loadOpts(loadedEmbedOptions, loader);
   const parsedOpts = await loadOpts(opts, loader);
 
   const mergedOpts = {
@@ -513,5 +522,5 @@ async function _embed(
     view.finalize();
   }
 
-  return {view, spec, vgSpec, finalize};
+  return {view, spec, vgSpec, finalize, embedOptions: opts};
 }

test/embed.test.ts

@@ -401,7 +401,24 @@ test('can set loader via usermeta', async () => {
     },
   });
   expect(result).toBeTruthy();
+  expect(result.embedOptions.loader).toEqual({
+    target: '_blank',
+  });
   expect((result.view as any)._loader.options).toEqual({
     target: '_blank',
   });
 });
+
+test('cannot set style via usermeta', async () => {
+  const el = document.createElement('div');
+  const result = await embed(el, {
+    ...vlSpec,
+    usermeta: {
+      embedOptions: {
+        defaultStyle: 'body {color: red}',
+      },
+    },
+  });
+  expect(result).toBeTruthy();
+  expect(result.embedOptions.defaultStyle).toBe(false);
+});

yarn.lock

@@ -6962,10 +6962,10 @@ rollup-plugin-ts@^2.0.5:
     ts-clone-node "^0.3.30"
     tslib "^2.3.1"
 
-rollup@2.67.1:
-  version "2.67.1"
-  resolved "https://registry.yarnpkg.com/rollup/-/rollup-2.67.1.tgz#4402665706fa00f321d446ce45f880e02cf54f01"
-  integrity sha512-1Sbcs4OuW+aD+hhqpIRl+RqooIpF6uQcfzU/QSI7vGkwADY6cM4iLsBGRM2CGLXDTDN5y/yShohFmnKegSPWzg==
+rollup@2.67.2:
+  version "2.67.2"
+  resolved "https://registry.yarnpkg.com/rollup/-/rollup-2.67.2.tgz#d95e15f60932ad21e05a870bd0aa0b235d056f04"
+  integrity sha512-hoEiBWwZtf1QdK3jZIq59L0FJj4Fiv4RplCO4pvCRC86qsoFurWB4hKQIjoRf3WvJmk5UZ9b0y5ton+62fC7Tw==
   optionalDependencies:
     fsevents "~2.3.2"