A CORS issue for loading data from web

[TonyLianLong]

The following spec (w/ code to add the plot) is rendered correctly in the current version of plotgallery. However, thumbnail does not work (either in a browser or Electron). Through debugging and testing, a highly possible reason is that because it uses an external source of data, and the function that we are using to convert to an PNG URL will not work under this condition for web security.

addPlot({type: "vega", data:{
  "$schema": "https://vega.github.io/schema/vega-lite/v4.json",
  "width": 500,
  "height": 300,
  "data": {"url": "https://vega.github.io/vega-lite/examples/data/cars.json"},
  "mark": "bar",
  "encoding": {
    "x": {
      "field": "Origin",
      "type": "nominal"
    },
    "y": {
      "aggregate": "count",
      "type": "quantitative"
    }
  }
}})

[TonyLianLong]

This describes the issue that I suspect: https://developer.mozilla.org/en-US/docs/Web/HTML/CORS_enabled_image. I noticed that we have set webSecurity to false in multiple places, but I still wonder whether this completely disables CORS.

[TonyLianLong]

The code that converts the canves to URL is here: https://github.com/julia-vscode/plotgallery/blob/master/src/Plot.tsx#L23

[davidanthoff]

We generally have a lot of problems with these url paths, they also don't work properly if one links to a local file on disc.

I would have thought, though, that this example works because the data comes via http, not from the local file system...

[TonyLianLong]

Then are we going to support either data from local or data from http?

[davidanthoff]

Well, I think the goal would be to support both :) But we should fix the http case first, the local case is more difficult.