smurching
commented
4 years ago @patryk-oleniuk thanks for raising this - adding the allow-same-origin attribute does seem to introduce a security vulnerability, in that I'm able to log an artifact that makes GET & POST requests to my local MLflow server once loaded into the UI.
In particular, I can log an artifact like the following (where my local UI is running on http://localhost:3000):
<html>
<script src="http://ajax.googleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js" type="text/javascript"></script>
<script>
console.log("hi from sid's script " + document.cookie);
var jqxhr0 = $.post( "http://localhost:3000/ajax-api/2.0/mlflow/runs/search", function() {
})
.done(function(data) {
alert( "search runs success" + JSON.stringify(data) );
})
.fail(function(err) {
console.log( "error " + JSON.stringify(err) );
})
.always(function() {
console.log( "finished" );
});
var jqxhr = $.get( "http://localhost:3000/ajax-api/2.0/mlflow/experiments/list", function() {
})
.done(function(data) {
console.log( "list experiments success" + JSON.stringify(data) );
})
.fail(function(err) {
console.log( "error " + JSON.stringify(err) );
})
.always(function() {
console.log( "finished" );
});
</script>
</html>and observe the following in the browser console:
hi from sid's script
49a89bee-0fd5-447b-a718-de08d98aa22a:9 search runs success{}
49a89bee-0fd5-447b-a718-de08d98aa22a:15 finished
49a89bee-0fd5-447b-a718-de08d98aa22a:24 list experiments success{"experiments":[{"experiment_id":"0","name":"Default","artifact_location":"./mlruns/0","lifecycle_stage":"active"},{"experiment_id":"6","name":"HTML test","artifact_location":"file:///Users/sid.murching/code/mlflow/mlruns/6","lifecycle_stage":"active"},{"experiment_id":"1","name":"/Users/test/blah","artifact_location":"file:///Users/sid.murching/code/mlflow/mlruns/1","lifecycle_stage":"active"},{"experiment_id":"4","name":"runs-but-no-metrics-params","artifact_location":"file:///Users/sid.murching/code/mlflow/mlruns/4","lifecycle_stage":"active"},{"experiment_id":"3","name":"my-empty-experiment","artifact_location":"file:///Users/sid.murching/code/mlflow/mlruns/3","lifecycle_stage":"active"},{"experiment_id":"2","name":"/Users/test/blahh","artifact_location":"file:///Users/sid.murching/code/mlflow/mlruns/2","lifecycle_stage":"active"},{"experiment_id":"5","name":"simple-parent-child","artifact_location":"file:///Users/sid.murching/code/mlflow/mlruns/5","lifecycle_stage":"active"}]}
49a89bee-0fd5-447b-a718-de08d98aa22a:30 finishedMore detail
Because we directly embed the user-supplied artifact into our iframe via a blob:/ URL, the iframed HTML artifact has the same origin as the window serving it (as per MDN docs). Adding the allow-same-origin attribute allows the iframed content to make requests without automatically failing the same-origin policy, which in turn allows GET & POST requests to be made from the iframed HTML to my local MLflow server (these requests would otherwise fail as the local server doesn't allow CORS)
patryk-oleniuk
stale[bot]
Zangr
mrDzurb
chenmoneygithub
erenz14
The current HTML artifact is great for static plots, however I'd like to embed some DASH dashboards, like this one https://dash-demo.plotly.host/ddk-clinical-trial-dashboard
The way I'm imagining this, is I create an HTML file and log it through
mlflow.log_artifact(..):Currently, it does not render, and I get an error (in my browser using inspect) :
After debugging MLFlow code, I discovered that this is because the iframe where the HTML artifact is rendered only has
sandbox="allow-scripts"and what I need for DASH dashboard issandbox="allow-same-origin allow-scripts ". After modifying this, my HTML is rendering nicely.Therefore, I would like to request to modify that line, if possible. in the file https://github.com/mlflow/mlflow/blob/master/mlflow/server/js/src/components/artifact-view-components/ShowArtifactHtmlView.js#L60
replace this :
System information
mlflow --version): 1.3