From 70578d7e4f24841f02d0b0633043a2848d615186 Mon Sep 17 00:00:00 2001
From: Bryce Kwon <bryce@brycekwon.com>
Date: Sun, 25 Oct 2026 12:10:33 -1000
Subject: Draw the diffstat bars as SVG

The bars were cells spanning up to 1000 columns of a nested table, which
kept them free of inline styles under a strict CSP but broke the HTML
table model, 18 errors on a commit page, and left Firefox's longest bar
short of the full width. An SVG canvas sized by its attributes is just
as safe under a CSP, validates, and draws every bar exactly to scale.
---
 tests/t0106-commit.sh | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'tests')

diff --git a/tests/t0106-commit.sh b/tests/t0106-commit.sh
index 2b924a0..3b50c2b 100755
--- a/tests/t0106-commit.sh
+++ b/tests/t0106-commit.sh
@@ -22,6 +22,12 @@ test_expect_success 'find diff summary' '
 	grep "1 file changed, 1 insertion, 0 deletions" tmp
 '
 
+# A strict CSP refuses an inline style, so the bar takes its widths from SVG
+# attributes, which also leave the page valid.
+test_expect_success 'the diffstat bar is an SVG sized by its attributes' '
+	grep "<td class=.graph.><svg viewBox=.0 0 1000 1. preserveAspectRatio=.none. aria-hidden=.true.><rect class=.add. width=.1000. height=.1./></svg></td>" tmp
+'
+
 test_expect_success 'get root commit' '
 	root=$(cd repos/foo && git rev-list --reverse HEAD | head -1) &&
 	cgit_url "foo/commit&id=$root" >tmp &&
-- 
cgit 2.9.2