andygrove opened a new issue, #6020: URL: https://github.com/apache/datafusion-comet/issues/6020
## Describe the bug The mermaid diagrams on the published documentation site do not render. They appear as raw diagram source instead of a picture, for example on <https://datafusion.apache.org/comet/contributor-guide/memory_management.html>. This is not specific to that page. Every page carrying a ` ```mermaid ` fence is affected, including <https://datafusion.apache.org/comet/contributor-guide/ci.html>. ## Steps to reproduce Open either page above in a browser and look at the diagrams, or check the browser console for the Content-Security-Policy violation. ## Expected behavior The diagrams render as diagrams. ## Additional context The cause is not the diagram sources and not the Sphinx configuration. Both diagram sources parse cleanly under mermaid 11.12.1, and the pinned CDN module returns HTTP 200. `sphinxcontrib-mermaid` defaults to `mermaid_output_format = 'raw'`, which draws the diagrams in the reader's browser and emits: ```js import mermaid from "https://cdn.jsdelivr.net/npm/[email protected]/dist/mermaid.esm.min.mjs";; ``` The ASF serves `*.apache.org` with a `Content-Security-Policy` whose `script-src` allows only `'self'`, `data:`, `blob:` and a handful of apache.org / apachecon / scarf.sh hosts: ``` script-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' https://www.apachecon.com/ https://www.communityovercode.org/ https://*.apache.org/ https://apache.org/ https://*.scarf.sh/ ``` `cdn.jsdelivr.net` is not on that list, so the browser blocks the import, mermaid.js never loads, and the `<pre class="mermaid">` blocks are left as text. The same header is served on `airflow.apache.org` and `arrow.apache.org`, so this is ASF infrastructure rather than anything configured in this repository, and `.asf.yaml` has no knob for it. `apache/arrow` hits the same wall and works around it with `mermaid_output_format = 'svg'`, which pre-renders the diagrams with `mermaid-cli` at build time and embeds them as `<object data="../_images/mermaid-<hash>.svg" type="image/svg+xml">`. That is served from `'self'` and needs no script, so the CSP does not apply. Their published pages render correctly. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
