CSP directive error in tensorboard plugin

[ameypatelNvidia]

Hi,

I am using tensorboard to create a plugin so that I can render custom charts. I wish to use Chart.JS to add this feature and need to add a script to be able to use it. I do so by calling the loadScript function here in the example plugin.

However, I get Refused to load the script 'https://cdnjs.cloudflare.com/ajax/libs/Chart.js/2.9.4/Chart.js' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-eval' 'sha256-PVZp/wXI2V6hq7T2aNiDNM+vJWIOWwNwyhE53i+6lSQ='". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

function loadScript() {
  const script = document.createElement('script');
  script.src = "https://cdnjs.cloudflare.com/ajax/libs/Chart.js/2.9.4/Chart.js";
  document.body.appendChild(script);
  console.log("I am here...Trying to load ", url);
}

Is there a better way to plot custom charts?

[bmd3k]

Hello @ameypatelNvidia ,

There had been some internal discussion in the past about allowing plugins to modify the Content Security Policy configuration but I don't think it ever materialized. We could take another look if it would be helpful to you.

One alternative: If you are building and running tensorboard from source or have a fork of tensorboard, you can modify the CSP configuration here:

• https://cs.opensource.google/tensorflow/tensorboard/+/master:tensorboard/backend/http_util.py;l=200;drc=5c22b0c66e090ca631420f33688523c3be1d61a6

Another alternative: Some users choose generate charts and then log them as image summaries and load them in the images dashboard.

[ameypatelNvidia]

Thanks for the response. If plugins could modify the Content Security Policy, that would be great.

As of now, I am running the plugin but my console is flooded with In 3.0, this warning will become an error: X-Content-Type-Options is required to be "nosniff". This seems to again be specific to the server and browser. Is there something that can be done to update the the X-Content-Type-Options?