Skip to content

Commit

Permalink
fix: avoid closing the script tag early by escaping a forward slash (#…
Browse files Browse the repository at this point in the history
…1665)

Closes #1562
Closes #802
Related #804
  • Loading branch information
maartenbreddels authored Oct 27, 2021
1 parent 968c5fb commit 11ea593
Show file tree
Hide file tree
Showing 3 changed files with 5 additions and 2 deletions.
3 changes: 3 additions & 0 deletions nbconvert/exporters/templateexporter.py
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,9 @@
'get_metadata': filters.get_metadata,
'convert_pandoc': filters.convert_pandoc,
'json_dumps': json.dumps,
# browsers will parse </script>, closing a script tag early
# Since JSON allows escaping forward slash, this will still be parsed by JSON
'escape_html_script': lambda x: x.replace('</script>', '<\\/script>'),

This comment has been minimized.

Copy link
@pwntester

pwntester Nov 2, 2021

Note that </script > is also a a valid closing tag. It would be more secure to html encode angle brackets

'strip_trailing_newline': filters.strip_trailing_newline,
'text_base64': filters.text_base64,
}
Expand Down
2 changes: 1 addition & 1 deletion share/jupyter/nbconvert/templates/classic/base.html.j2
Original file line number Diff line number Diff line change
Expand Up @@ -267,7 +267,7 @@ var element = $('#{{ div_id }}');
{% set mimetype = 'application/vnd.jupyter.widget-state+json'%}
{% if mimetype in nb.metadata.get("widgets",{})%}
<script type="{{ mimetype }}">
{{ nb.metadata.widgets[mimetype] | json_dumps }}
{{ nb.metadata.widgets[mimetype] | json_dumps | escape_html_script }}
</script>
{% endif %}
{{ super() }}
Expand Down
2 changes: 1 addition & 1 deletion share/jupyter/nbconvert/templates/lab/base.html.j2
Original file line number Diff line number Diff line change
Expand Up @@ -273,7 +273,7 @@ var element = document.getElementById('{{ div_id }}');
{% set mimetype = 'application/vnd.jupyter.widget-state+json'%}
{% if mimetype in nb.metadata.get("widgets",{})%}
<script type="{{ mimetype }}">
{{ nb.metadata.widgets[mimetype] | json_dumps }}
{{ nb.metadata.widgets[mimetype] | json_dumps | escape_html_script }}
</script>
{% endif %}
{{ super() }}
Expand Down

0 comments on commit 11ea593

Please sign in to comment.