I have a security-related question with regards to d3.js
D3.js essentially allows data to drive dynamic charts etc, among other features.
The "d3js.org" landing page mentions "D3 (js) allows you to bind arbitrary data to a DOM".
Functions such as d3.csv.parse can be used to read in "arbitrary" data. However, the chart in question would be expecting certain types of data etc.
Can such a library truly accept "arbitrary" data from anonymous users? Could a user potentially parse carefully crafted data to produce an unexpected result with D3? (ie, authorized JS execution).
What may be best practise here for wanting to parse arbitrary to D3?