search

go-gitea / gitea

Git with a cup of tea! Painless self-hosted all-in-one software development service, including Git hosting, code review, team collaboration, package registry and CI/CD
https://gitea.com
MIT License
44.98k stars 5.48k forks source link

Client side rendering of .ipynb has not been ported from gogs #3279

Closed memetb closed 2 years ago

memetb commented 6 years ago

Description

The client-side notebook preview functionality has not been backported from the original gogs repo.

https://try.gogs.io/niklas/ipynb-test/src/master/README.ipynb https://try.gitea.io/memetb/test-ipynb/src/branch/master/Untitled.ipynb

Issue #3025 mentions using RENDER_COMMAND = jupyter nbconvert --to html --stdin --stdout however, there are multiple reasons why this can be problematic:

thehowl commented 6 years ago

Gogs uses notebookjs for displaying jupyter notebooks. I still need to research whether notebookjs allows the execution of arbitrary code (like JS code), and in the case it does, it's a no-go and we should instead consider making (or finding) a parser that only displays markup and does not run any user code.

memetb commented 6 years ago

Ok, I've uploaded a version of the notebook with javascript and style sheet injection. The quick answer is that, as configured, it does allow for execution of code. However, this doesn't constitute an audit of the code, perhaps there's a way to disable it.

https://try.gitea.io/memetb/test-ipynb/src/branch/master/Untitled.ipynb https://try.gogs.io/testbbar/test-ipynb/src/master/Untitled.ipynb

Looking at nbpreview which makes use of notebookjs, I can see that it's possible to remove js. Although I'm not yet sure how it's being done.

thehowl commented 6 years ago

Yeah, it seems like code generated from notebookjs should be run through an HTML cleaner/purifier/sanitizer first.

memetb commented 6 years ago

nbpreview is doing something to this effect. The thing works as a standalone html file, so there may be client side library parameters which allow for this.

Either that or it's buggy and not behaving the way it wants to.

memetb commented 6 years ago

Further info:

This is the feature being proposed on gogs.

It fails if I put javascript in the dom events. You're right, a server side javascript filter will likely be necessary.

nbviewer seems to do what we're wanting. (Other link leads to a broken preview).

To test it, just download the ipynb from the above repos and drag and drop.

Fyi, I've attached what the original file looks like (fwiw, none of the three previews so far have rendered the style sheet - which isn't necessarily a bad thing) screenshot-2018-1-1 untitled

memetb commented 6 years ago

It would seem jupyter themselves (c.f. page 34) advocate for the use of Google Caja. So far, from my searching, I haven't found any other library which does what Caja claims to do.

It would also appear caja has a standalone js sanitizer.

Let me know if you require further research.

lstolcman commented 6 years ago

@memetb Could you share your config for rendering jupyter notebook files?

memetb commented 6 years ago

@lstolcman I'm not sure what you're asking for. Do you mean standalone? I'm using a standard out of the box anaconda installation, if that's what you mean.

amit-pimco commented 6 years ago

is it planned yet ? It was working on gogs. I had migrated to gitea and ipynb rendering stopped working.

pavilo commented 5 years ago

It would be relatively easy to add ipynb support through an external markup renderer (e.g. using jupyter nbconvert) when #3025 is resolved. A vanilla version would call the command every time the notebook has to be rendered. Next (and very reasonable) step would be to cache the rendered file until the source file is changed (e.g. scoping the cache to the source file hash). I think the approach is valid for all custom markup rendering, not only jupyter.

I think the right place for the caching layer is inside the custom renderer (which could be in its own docker container). To enable this, we need gitea to pass not only the file content and URLs but also the commit ID to the renderer.

westurner commented 5 years ago

"Rendering of jupyter notebook 'rich output' is still missing some capabilities" https://gitlab.com/gitlab-org/gitlab-ce/issues/32784#note_97778959

...

HarvsG commented 4 years ago

You may find https://github.com/go-gitea/gitea/pull/12261 and this draft tutorial helpful.

klamann commented 4 years ago

@HarvsG using nbconvert is not a satisfiable solution, due to all the reasons that were mentioned in the first post (security, performance, dependencies). A solution built around a JS library like nbviewer.js would be preferable.