René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Strict CSP breaks bold tags in annotation text","articleBody":"Using the new strict CSP support breaks bold tags in annotation text.\n\n### Steps to reproduce:\n1. Include the plotly.css file.\n2. Content Security Policy that disallows inline stylesheets.\n3. Annotations where the text includes `\u003cb\u003e` tag.\n\nI've reproduced this problem in Vue 3 with Plotly 3.0.1 here: https://stackblitz.com/edit/vitejs-vite-1gco7d7q?file=src%2Fcomponents%2FPlotlyExample.vue\n\nThe Plotly code is like so, with bold tags around the text annotations **X axis** and **Y axis**\n```\n  Plotly.newPlot(plotlyContainer.value, [{ x: [1, 2, 3], y: [2, 1, 2] }], {\n    annotations: [\n      {\n        xref: 'paper',\n        yref: 'paper',\n        x: 0,\n        xanchor: 'right',\n        y: 1,\n        yanchor: 'bottom',\n        text: '\u003cb\u003eX axis\u003c/b\u003e label',\n        showarrow: false,\n      },\n      {\n        xref: 'paper',\n        yref: 'paper',\n        x: 1,\n        xanchor: 'left',\n        y: 0,\n        yanchor: 'top',\n        text: '\u003cb\u003eY axis\u003c/b\u003e label',\n        showarrow: false,\n      },\n    ],\n  });\n```\n\nCSP:\n```\n    \u003cmeta\n      http-equiv=\"Content-Security-Policy\"\n      content=\"default-src 'self'; img-src 'self' data: blob:; style-src 'self' 'sha256-jehvI5/Zi1PSH21Fi6ZfQYAtiGucyVGUH4ziRLU+Bfc=';\"\n    /\u003e\n```\n\n(NOTE: because of how the Vite dev server works, I need to include the sha256 checksum of the plotly-3.0.1.css file, in a production build it wouldn't be necessary.)\n\n### Expected result:\n\n![Image](https://github.com/user-attachments/assets/96fa92e2-a166-4c2f-b9c9-d76cf569b0c9)\n\nI produced this image by commenting out the CSP meta tag in the reproduction code linked to above.\n\n### Actual result:\n\n![Image](https://github.com/user-attachments/assets/cfefaade-6844-4e56-863b-5063fa02f570)","author":{"url":"https://github.com/inari-mchristie","@type":"Person","name":"inari-mchristie"},"datePublished":"2025-02-27T15:52:34.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":3},"url":"https://github.com/7380/plotly.js/issues/7380"}