Skip to content

fix(components): add RTLTextPlugin prop to disable remote script loading (#2477)#3336

Open
pierreeurope wants to merge 1 commit intokeplergl:masterfrom
pierreeurope:fix/rtl-plugin-csp-option-2477
Open

fix(components): add RTLTextPlugin prop to disable remote script loading (#2477)#3336
pierreeurope wants to merge 1 commit intokeplergl:masterfrom
pierreeurope:fix/rtl-plugin-csp-option-2477

Conversation

@pierreeurope
Copy link
Copy Markdown
Contributor

Summary

Adds an RTLTextPlugin prop to the KeplerGl and MapContainer components, allowing users to disable the automatic loading of the mapbox-gl-rtl-text plugin from a remote URL.

Problem

react-map-gl loads the RTL text plugin from https://api.mapbox.com/mapbox-gl-js/plugins/mapbox-gl-rtl-text/v0.2.3/mapbox-gl-rtl-text.js by default. This violates strict Content Security Policy (CSP) environments where loading external scripts is prohibited.

See also: visgl/react-map-gl#2310

Solution

Thread the RTLTextPlugin prop from KeplerGlMapContainerreact-map-gl's Map component. Users can now:

// Disable RTL text plugin loading entirely
<KeplerGl RTLTextPlugin={false} ... />

// Or point to a self-hosted version
<KeplerGl RTLTextPlugin="/static/mapbox-gl-rtl-text.js" ... />

When the prop is not provided, the default react-map-gl behavior is preserved (loads from Mapbox CDN).

Changes

  • src/components/src/kepler-gl.tsx: Add RTLTextPlugin to KeplerGLBasicProps and pass it to MapContainer
  • src/components/src/map-container.tsx: Add RTLTextPlugin to MapContainerProps and include it in mapProps

Closes #2477

…ing (keplergl#2477)

Add RTLTextPlugin prop to KeplerGl and MapContainer components,
allowing users to pass RTLTextPlugin={false} to prevent react-map-gl
from loading the mapbox-gl-rtl-text plugin from a remote URL.

This is needed in strict Content Security Policy (CSP) environments
where loading external scripts is prohibited.

Closes keplergl#2477

Signed-off-by: pierreeurope <pierre.europe@pm.me>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug] RTL plugin remote load disable for content security policy

1 participant