From 70578d7e4f24841f02d0b0633043a2848d615186 Mon Sep 17 00:00:00 2001
From: Bryce Kwon <bryce@brycekwon.com>
Date: Sun, 25 Oct 2026 12:10:33 -1000
Subject: Draw the diffstat bars as SVG

The bars were cells spanning up to 1000 columns of a nested table, which
kept them free of inline styles under a strict CSP but broke the HTML
table model, 18 errors on a commit page, and left Firefox's longest bar
short of the full width. An SVG canvas sized by its attributes is just
as safe under a CSP, validates, and draws every bar exactly to scale.
---
 source/ui-diff.c | 25 +++++++++----------------
 1 file changed, 9 insertions(+), 16 deletions(-)

(limited to 'source')

diff --git a/source/ui-diff.c b/source/ui-diff.c
index 2da44c4..8d8e680 100644
--- a/source/ui-diff.c
+++ b/source/ui-diff.c
@@ -73,17 +73,6 @@ static void release_bodies(void)
 		strbuf_release(&items[i].body);
 }
 
-/*
- * One bar segment of the per-file diffstat graph. The bar is a fixed-layout
- * table whose row always spans 1000 columns, so a segment takes its width
- * through colspan rather than an inline style a CSP would have to allow.
- */
-static void print_graph_cell(const char *class, int span)
-{
-	if (span > 0)
-		htmlf("<td class='%s' colspan='%d'></td>", class, span);
-}
-
 static void print_fileinfo(struct fileinfo *info)
 {
 	int scale = max_changes ? max_changes : 1;
@@ -152,13 +141,17 @@ static void print_fileinfo(struct fileinfo *info)
 	}
 	htmlf("%u", info->added + info->removed);
 	html("</td><td class='graph'>");
-	html("<table><tr>");
 	add_span = (int)(info->added * 1000.0 / scale + 0.5);
 	rem_span = (int)(info->removed * 1000.0 / scale + 0.5);
-	print_graph_cell("add", add_span);
-	print_graph_cell("rem", rem_span);
-	print_graph_cell("none", 1000 - add_span - rem_span);
-	html("</tr></table></td></tr>\n");
+	// The bar is drawn on a canvas 1000 units wide that the cell stretches,
+	// so each segment takes its width from an attribute rather than from an
+	// inline style a CSP would have to allow.
+	html("<svg viewBox='0 0 1000 1' preserveAspectRatio='none' aria-hidden='true'>");
+	if (add_span > 0)
+		htmlf("<rect class='add' width='%d' height='1'/>", add_span);
+	if (rem_span > 0)
+		htmlf("<rect class='rem' x='%d' width='%d' height='1'/>", add_span, rem_span);
+	html("</svg></td></tr>\n");
 }
 
 /*
-- 
cgit 2.9.2