Add explicit constraints on allowable inline styles for rich text.

sandialabs · Sep 7, 2016 · ab4a7cc · ab4a7cc
1 parent 0251ad3
commit ab4a7cc
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 1 deletion.
diff --git a/toyplot/html.py b/toyplot/html.py
@@ -306,7 +306,7 @@ def _draw_text(
 
     def cascade_styles(node, font_size):
         dy = node.get("dy", 0)
-        style = toyplot.style.parse(node.get("style", ""))
+        style = toyplot.require.style(toyplot.style.parse(node.get("style", "")), allowed=toyplot.require.style.rich_text)
         if "font-size" in style:
             font_size = toyplot.units.convert(style.pop("font-size"), target="px", default="px", reference=font_size)
 

diff --git a/toyplot/require.py b/toyplot/require.py
@@ -82,6 +82,16 @@ def style(value, allowed):
     "-toyplot-anchor-shift",
     ])
 
+style.rich_text = set([
+    "fill",
+    "fill-opacity",
+    "font-size",
+    "font-weight",
+    "opacity",
+    "stroke",
+    "stroke-opacity",
+    "stroke-width",
+    ])
 
 def instance(value, types):
     """Verify the type of a value."""