search

pypa / readme_renderer

Safely render long_description/README files in Warehouse
Apache License 2.0
159 stars 89 forks source link

`twine check` fails when badges have a scale factor ... #304

Open kif opened 6 months ago

kif commented 6 months ago

As reported in: https://github.com/pypa/twine/issues/1102 twine check fails when parsing the readme file contains badges. If one of the badge has a scale factor, the readme_renderer fails claiming it is not allowed to access to the internet.

miketheman commented 4 months ago

Please provide a concrete reference to a readme that contains the problematic behavior - it's unclear from the linked issue which conditions lead to the problem.

bocklund commented 4 months ago

From https://github.com/PhasesResearchLab/ESPEI

python -m readme_renderer -f rst README.rst (.txt extension added for the upload to GitHub to work)

Gives output:

<string>:37: (WARNING/2) Cannot scale image!
  Could not get size from "docs/_static/cu-mg-mcmc-phase-diagram.png":
  Reading external files disabled.

README.rst

miketheman commented 3 months ago

Thanks for the error message, that points out a warning from docutils.

We have disabled the ability to read external files, which prevents docutils from trying to load images to scale these. See:

https://github.com/pypa/readme_renderer/blob/1d0497c37a6033d791c74e800590dcd0d34f6e08/readme_renderer/rst.py#L68-L71

I haven't looked too hard yet for what alternatives might be avilable, or if there's a way to only allow images, but now there's a reason.

marscher commented 1 week ago

This is actually a blocker to upload a new release for my project. Could this be non fatal maybe (as it used to be)? E.g. just do not render the image in that case. We just display a scaled logo in our readme. I think it is a fairly common use case.

Is the inclusion of external files considered a security risk?

I'd love to hear your opinion on that @miketheman, thank you.