From 228ee9182172a23ff0c9a0a3692cd1d6e21a37ff Mon Sep 17 00:00:00 2001 From: Jason Grout Date: Wed, 14 Aug 2019 16:02:54 -0700 Subject: [PATCH 1/4] Properly escape template variables --- dev_mode/templates/partial.html | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/dev_mode/templates/partial.html b/dev_mode/templates/partial.html index 673b9c52d8f8..e94ef617fe8d 100644 --- a/dev_mode/templates/partial.html +++ b/dev_mode/templates/partial.html @@ -1,12 +1,14 @@ - +{# Copy so we do not modify the page_config with updates. #} +{% set page_config_full = page_config.copy() %} + +{# Set a dummy variable - we just want the side effect of the update. #} +{% set _ = page_config_full.update(baseUrl=base_url, wsUrl=ws_url) %} + + {% block favicon %} - - + + {% endblock %} From f655977f43b5bd3f79ba54efd6a0f453e235dbb9 Mon Sep 17 00:00:00 2001 From: Jason Grout Date: Fri, 16 Aug 2019 09:41:17 -0700 Subject: [PATCH 2/4] Do not try to overly escape the notebook version info anymore. --- jupyterlab/extension.py | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/jupyterlab/extension.py b/jupyterlab/extension.py index f82aedf60247..cb6559018255 100644 --- a/jupyterlab/extension.py +++ b/jupyterlab/extension.py @@ -141,13 +141,9 @@ def load_jupyter_server_extension(nbapp): page_config['devMode'] = dev_mode page_config['token'] = nbapp.token - # Export the version info tuple to a JSON array. This gets printed - # inside double quote marks, so we render it to a JSON string of the - # JSON data (so that we can call JSON.parse on the frontend on it). - # We also have to wrap it in `Markup` so that it isn't escaped - # by Jinja. Otherwise, if the version has string parts these will be - # escaped and then will have to be unescaped on the frontend. - page_config['notebookVersion'] = Markup(dumps(dumps(version_info))[1:-1]) + # Client-side code assumes notebookVersion is a JSON-encoded string + # TODO: fix this when we can make such a change + page_config['notebookVersion'] = dumps(version_info) if nbapp.file_to_run and type(nbapp).__name__ == "LabApp": relpath = os.path.relpath(nbapp.file_to_run, nbapp.notebook_dir) From d81f6d88317318200b36f4ed43696edb5cc7f519 Mon Sep 17 00:00:00 2001 From: Jason Grout Date: Fri, 16 Aug 2019 11:41:29 -0700 Subject: [PATCH 3/4] Escape instead of url encode in the jinja template urlencode will escape :, but we want to preserve : if there is a full url. --- dev_mode/templates/partial.html | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/dev_mode/templates/partial.html b/dev_mode/templates/partial.html index e94ef617fe8d..daf8a06290fb 100644 --- a/dev_mode/templates/partial.html +++ b/dev_mode/templates/partial.html @@ -9,6 +9,6 @@ {% block favicon %} - - + + {% endblock %} From 11828db625813d3573cb48281d967ff70edc7e7e Mon Sep 17 00:00:00 2001 From: Jason Grout Date: Fri, 16 Aug 2019 11:58:59 -0700 Subject: [PATCH 4/4] Correct escaping in other templates we distribute. --- dev_mode/templates/error.html | 4 ++-- examples/app/templates/error.html | 8 ++++---- examples/app/templates/index.html | 20 ++++++++++--------- examples/cell/index.html | 11 +++++----- examples/console/index.html | 12 ++++++----- examples/filebrowser/index.html | 12 ++++++----- examples/notebook/index.html | 2 +- examples/terminal/index.html | 13 ++++++------ .../examples/browser-require/index.html | 9 +++++++-- packages/services/examples/browser/index.html | 9 +++++++-- .../typescript-browser-with-output/index.html | 9 +++++++-- 11 files changed, 66 insertions(+), 43 deletions(-) diff --git a/dev_mode/templates/error.html b/dev_mode/templates/error.html index 5c389852810e..70158728d1ca 100644 --- a/dev_mode/templates/error.html +++ b/dev_mode/templates/error.html @@ -8,7 +8,7 @@ - {% block title %}{{page_title}}{% endblock %} + {% block title %}{{page_title | escape}}{% endblock %} {% block favicon %}{% endblock %} @@ -30,7 +30,7 @@ {% block h1_error %}

JupyterLab assets not detected, please rebuild

{% endblock h1_error %} diff --git a/examples/app/templates/error.html b/examples/app/templates/error.html index 266937fb4bae..4e66c111301d 100644 --- a/examples/app/templates/error.html +++ b/examples/app/templates/error.html @@ -8,7 +8,7 @@ - {% block title %}{{page_title}}{% endblock %} + {% block title %}{{page_title | e}}{% endblock %} {% block favicon %}{% endblock %} @@ -28,13 +28,13 @@
{% block h1_error %} -

{{status_code}} : {{status_message}}

+

{{status_code | e}} : {{status_message | e}}

{% endblock h1_error %} {% block error_detail %} {% if message %}

The error was:

- 
{{message}}
+ 
{{message | e}}
{% endif %} {% endblock %} @@ -48,7 +48,7 @@

{{status_code}} : {{status_message}}

var tb = document.getElementsByClassName('traceback')[0]; tb.scrollTop = tb.scrollHeight; {% if message %} - console.error("{{message}}") + console.error("{{message | e}}") {% endif %} }; diff --git a/examples/app/templates/index.html b/examples/app/templates/index.html index b1e54724ced0..de1de05687fb 100644 --- a/examples/app/templates/index.html +++ b/examples/app/templates/index.html @@ -1,17 +1,19 @@ - {{page_config['appName']}} + {{page_config['appName'] | e}} - - + {# Copy so we do not modify the page_config with updates. #} + {% set page_config_full = page_config.copy() %} + + {# Set a dummy variable - we just want the side effect of the update. #} + {% set _ = page_config_full.update(baseUrl=base_url, wsUrl=ws_url) %} + + + - - + {% set page_config_full = {'baseUrl': base_url, 'token': token} %} + + + - - + {% set page_config_full = {'baseUrl': base_url, 'token': token} %} + + + + - + {% set page_config_full = {'baseUrl': base_url, 'token': token} %} + + + + - + - + {% set page_config_full = {'baseUrl': base_url, 'token': token, 'terminalsAvailable': terminals_available} %} + + + + + {% set page_config_full = {'baseUrl': base_url} %} + + +

Run code!

Type code in the text area and click run to execute it. @@ -33,6 +38,6 @@

Run code!

} }); - + diff --git a/packages/services/examples/browser/index.html b/packages/services/examples/browser/index.html index dae0c538837f..89b619961b05 100644 --- a/packages/services/examples/browser/index.html +++ b/packages/services/examples/browser/index.html @@ -5,8 +5,13 @@ - - + {% set page_config_full = {'baseUrl': base_url} %} + + + + 

   
 
diff --git a/packages/services/examples/typescript-browser-with-output/index.html b/packages/services/examples/typescript-browser-with-output/index.html
index 187fbe1f4f8b..7daa5a6c105e 100644
--- a/packages/services/examples/typescript-browser-with-output/index.html
+++ b/packages/services/examples/typescript-browser-with-output/index.html
@@ -5,8 +5,13 @@
     
   
   
-    
-    
+    {% set page_config_full = {'baseUrl': base_url} %}
+
+    
+
+