import external notebooks inputs are not validated

att / rcloud

Collaborative data analysis and visualization

http://rcloud.social

MIT License

432 stars 142 forks source link

import external notebooks inputs are not validated #2728

Closed gordonwoodhull closed 4 years ago

gordonwoodhull commented 4 years ago

Since the functions do GETs on the URLs provided, they can be used to cause the server to fetch file:// URLs or non-notebooks (that happen to have /gists/ in them - okay, not huge risk).

The inputs should be validated.