Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Vega] Allow image loading without CORS policy by changing the default to crossOrigin=null #91991

Merged
merged 4 commits into from
Feb 26, 2021
Merged

[Vega] Allow image loading without CORS policy by changing the default to crossOrigin=null #91991

merged 4 commits into from
Feb 26, 2021

Conversation

VladLasitsa
Copy link
Contributor

Closes: #83978

Summary

Add crossOrigin=null to sanitaze method so that allow Vega users to load images from any domain.

alexwizp
alexwizp reviewed Feb 19, 2021
View reviewed changes
src/plugins/vis_type_vega/public/vega_view/vega_base_view.js
return originalSanitize(uri, options);
const result = await originalSanitize(uri, options);
// This will allow Vega users to load images from any domain.
result.crossOrigin = null;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@wylieconlon I'm not a big fan of this kind of changes. Could you please help me to reproduce that issue locally. I've modified hosts file, set vis_type_vega.enableExternalUrls: true and use the following vega spec with image from external resource.

Vega spec:

{
  $schema: https://vega.github.io/schema/vega/v5.json
  marks: [
  {
      "type": "image",
      "encode": {
        "enter": {
          "url": {
            "value": "https://cdn.glitch.com/4c9ebeb9-8b9a-4adc-ad0a-238d9ae00bb5%2Fmdn_logo-only_color.svg?1535749917189"
          }
        }
      }
    }
  
  ]
}

Result:
image

Image loaded without any warnings/errors in console

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@alexwizp the image that you're found allows all CORS requests, so it is not a good example of the type of image that causes this behavior. Most CDNs automatically allows CORS requests for images, so maybe the best place to find this kind of image is a non-CDN source. Maybe setting up a local HTTP server on a different port would be a better example.

wylieconlon
wylieconlon approved these changes Feb 19, 2021
View reviewed changes
Copy link
Contributor

@wylieconlon wylieconlon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I tested this in Firefox by setting up a local image server using python -m SimpleHTTPServer in my screenshots directory, and was able to compare the existing behavior to this PR. This PR fixes the loading behavior when CORS headers are not set on images.

@alexwizp
Copy link
Contributor

@elasticmachine merge upstream

@alexwizp alexwizp added Feature:Vega Vega visualizations release_note:fix v7.13.0 v8.0.0 Team:Visualizations Visualization editors, elastic-charts and infrastructure labels Feb 25, 2021
@alexwizp alexwizp marked this pull request as ready for review February 25, 2021 07:43
@alexwizp alexwizp requested a review from a team February 25, 2021 07:43
@elasticmachine
Copy link
Contributor

Pinging @elastic/kibana-app (Team:KibanaApp)

@alexwizp
Copy link
Contributor

@elasticmachine merge upstream

@kibanamachine
Copy link
Contributor

💚 Build Succeeded

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
visTypeVega 2.7MB 2.7MB +55.0B

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @VladLasitsa

stratoula
stratoula approved these changes Feb 25, 2021
View reviewed changes
Copy link
Contributor

@stratoula stratoula left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review only, LGTM

@stratoula
Copy link
Contributor

@elasticmachine run elasticsearch-ci/docs

@VladLasitsa VladLasitsa merged commit 4192ea7 into elastic:master Feb 26, 2021
VladLasitsa added a commit to VladLasitsa/kibana that referenced this pull request Feb 26, 2021
@VladLasitsa @kibanamachine
[Vega] Allow image loading without CORS policy by changing the defaul…
663b07d 
…t to crossOrigin=null (elastic#91991)

* changing the default to crossOrigin=null in Vega

* Fix eslint

Co-authored-by: Kibana Machine <[email protected]>
@VladLasitsa VladLasitsa mentioned this pull request Feb 26, 2021
Merged
gmmorris added a commit to gmmorris/kibana that referenced this pull request Feb 26, 2021
@gmmorris
Merge branch 'task-manager/docs-monitoring' of github.com:gmmorris/ki…
b56cc35 
…bana into task-manager/docs-monitoring

* 'task-manager/docs-monitoring' of github.com:gmmorris/kibana: (40 commits)
  [Security Solution][Case][Bug] Improve case logging (elastic#91924)
  [Alerts][Doc] Added README documentation for alerts plugin status and framework health checks configuration options. (elastic#92761)
  Add warning for EQL and Threshold rules if exception list contains value list items (elastic#92914)
  [Security Solution][Case] Fix subcases bugs on detections and case view (elastic#91836)
  [APM] Always allow access to Profiling via URL (elastic#92889)
  [Vega] Allow image loading without CORS policy by changing the default to crossOrigin=null (elastic#91991)
  skip flaky suite (elastic#92114)
  [APM] Fix for default fields in correlations view (elastic#91868) (elastic#92090)
  chore(NA): bump bazelisk to v1.7.5 (elastic#92905)
  [Maps] fix selecting EMS basemap does not populate input (elastic#92711)
  API docs (elastic#92827)
  [kbn/test] add import/export support to KbnClient (elastic#92526)
  Test fix management scripted field filter functional test and unskip it  (elastic#92756)
  [App Search] Create Curation view/functionality (elastic#92560)
  [Reporting/Discover] include the document's entire set of fields (elastic#92730)
  [Fleet] Add new index to fleet for artifacts being served out of fleet-server (elastic#92860)
  [Alerts][Doc] Added README documentation for API key invalidation configuration options. (elastic#92757)
  [Discover][docs] Add search for relevance (elastic#90611)
  [Alerts][Docs] Extended README.md and the user docs with the licensing information. (elastic#92564)
  [7.12][Telemetry] Security telemetry allowlist fix. (elastic#92850)
  ...
VladLasitsa added a commit that referenced this pull request Mar 1, 2021
@VladLasitsa @kibanamachine
[Vega] Allow image loading without CORS policy by changing the defaul…
ce18758 
…t to crossOrigin=null (#91991) (#92956)

* changing the default to crossOrigin=null in Vega

* Fix eslint

Co-authored-by: Kibana Machine <[email protected]>

Co-authored-by: Kibana Machine <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@wylieconlon wylieconlon wylieconlon approved these changes

@stratoula stratoula stratoula approved these changes

@alexwizp alexwizp alexwizp approved these changes

Assignees

@VladLasitsa VladLasitsa

Labels
Feature:Vega Vega visualizations release_note:fix Team:Visualizations Visualization editors, elastic-charts and infrastructure v7.13.0 v8.0.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

[Vega] Allow image loading without CORS policy by changing the default to crossOrigin=null
6 participants
@VladLasitsa @alexwizp @elasticmachine @kibanamachine @stratoula @wylieconlon