Home Explore Help
Register Sign In
ylproj
/
jupyterlab
2
0
Fork 0
Files Issues 0 Pull Requests 0 Wiki
Browse Source

Correct escaping in other templates we distribute.

Jason Grout 5 years ago
parent
d81f6d8831
commit
11828db625
11 changed files with 66 additions and 43 deletions
Unified View Show Diff Stats
  1. 2 2
      dev_mode/templates/error.html
  2. 4 4
      examples/app/templates/error.html
  3. 11 9
      examples/app/templates/index.html
  4. 6 5
      examples/cell/index.html
  5. 7 5
      examples/console/index.html
  6. 7 5
      examples/filebrowser/index.html
  7. 1 1
      examples/notebook/index.html
  8. 7 6
      examples/terminal/index.html
  9. 7 2
      packages/services/examples/browser-require/index.html
  10. 7 2
      packages/services/examples/browser/index.html
  11. 7 2
      packages/services/examples/typescript-browser-with-output/index.html

+ 2 - 2
dev_mode/templates/error.html
View File 

@@ -8,7 +8,7 @@ Distributed under the terms of the Modified BSD License.
 
 <head>
 
 <head>
 
   <meta charset="utf-8">
 
   <meta charset="utf-8">
 
 
 
-  <title>{% block title %}{{page_title}}{% endblock %}</title>
 
+  <title>{% block title %}{{page_title | escape}}{% endblock %}</title>
 
 
 
   {% block favicon %}<link rel="shortcut icon" type="image/x-icon" href="/static/base/images/favicon.ico">{% endblock %}
 
   {% block favicon %}<link rel="shortcut icon" type="image/x-icon" href="/static/base/images/favicon.ico">{% endblock %}
 
 
 
@@ -30,7 +30,7 @@ div#header, div#site {
 
     {% block h1_error %}
 
     {% block h1_error %}
 
     <h2>JupyterLab assets not detected, please rebuild</h2>
 
     <h2>JupyterLab assets not detected, please rebuild</h2>
 
     <script>
 
     <script>
 
-    console.error('Missing assets in "{{static_dir}}"');
 
+    console.error('Missing assets in "{{static_dir | escape}}"');
 
     </script>
 
     </script>
 
     {% endblock h1_error %}
 
     {% endblock h1_error %}
 
 </header>
 
 </header>

+ 4 - 4
examples/app/templates/error.html
View File 

@@ -8,7 +8,7 @@ Distributed under the terms of the Modified BSD License.
 
 <head>
 
 <head>
 
   <meta charset="utf-8">
 
   <meta charset="utf-8">
 
 
 
-  <title>{% block title %}{{page_title}}{% endblock %}</title>
 
+  <title>{% block title %}{{page_title | e}}{% endblock %}</title>
 
 
 
   {% block favicon %}<link rel="shortcut icon" type="image/x-icon" href="/static/base/images/favicon.ico">{% endblock %}
 
   {% block favicon %}<link rel="shortcut icon" type="image/x-icon" href="/static/base/images/favicon.ico">{% endblock %}
 
 
 
@@ -28,13 +28,13 @@ div#header, div#site {
 
 
 
 <div class="error">
 
 <div class="error">
 
     {% block h1_error %}
 
     {% block h1_error %}
 
-    <h1>{{status_code}} : {{status_message}}</h1>
 
+    <h1>{{status_code | e}} : {{status_message | e}}</h1>
 
     {% endblock h1_error %}
 
     {% endblock h1_error %}
 
     {% block error_detail %}
 
     {% block error_detail %}
 
     {% if message %}
 
     {% if message %}
 
     <p>The error was:</p>
 
     <p>The error was:</p>
 
     <div class="traceback-wrapper">
 
     <div class="traceback-wrapper">
 
-    <pre class="traceback">{{message}}</pre>
 
+    <pre class="traceback">{{message | e}}</pre>
 
     </div>
 
     </div>
 
     {% endif %}
 
     {% endif %}
 
     {% endblock %}
 
     {% endblock %}
 
@@ -48,7 +48,7 @@ window.onload = function () {
 
   var tb = document.getElementsByClassName('traceback')[0];
 
   var tb = document.getElementsByClassName('traceback')[0];
 
   tb.scrollTop = tb.scrollHeight;
 
   tb.scrollTop = tb.scrollHeight;
 
   {% if message %}
 
   {% if message %}
 
-  console.error("{{message}}")
 
+  console.error("{{message | e}}")
 
   {% endif %}
 
   {% endif %}
 
 };
 
 };
 
 </script>
 
 </script>

+ 11 - 9
examples/app/templates/index.html
View File 

@@ -1,17 +1,19 @@
 
 <!DOCTYPE html>
 
 <!DOCTYPE html>
 
 <html>
 
 <html>
 
 <head>
 
 <head>
 
-  <title>{{page_config['appName']}}</title>
 
+  <title>{{page_config['appName'] | e}}</title>
 
 </head>
 
 </head>
 
 <body>
 
 <body>
 
-  <script id='jupyter-config-data' type="application/json">{
 
-  {% for key, value in page_config.items() -%}
 
-  "{{ key }}": "{{ value }}",
 
-  {% endfor -%}
 
-  "baseUrl": "{{base_url}}",
 
-  "wsUrl": "{{ws_url}}"
 
- }</script>
 
-  <script src="{{page_config['fullStaticUrl']}}/bundle.js" main="index"></script>
 
+    {# Copy so we do not modify the page_config with updates. #}
 
+    {% set page_config_full = page_config.copy() %}
 
+    
+    {# Set a dummy variable - we just want the side effect of the update. #}
 
+    {% set _ = page_config_full.update(baseUrl=base_url, wsUrl=ws_url) %}
 
+    
+      <script id="jupyter-config-data" type="application/json">
 
+        {{ page_config_full | tojson }}
 
+      </script>
 
+  <script src="{{page_config['fullStaticUrl'] | e}}/bundle.js" main="index"></script>
 
 
 
   <script type="text/javascript">
 
   <script type="text/javascript">
 
     /* Remove token from URL. */
 
     /* Remove token from URL. */

+ 6 - 5
examples/cell/index.html
View File 

@@ -5,11 +5,12 @@
 
     <script type="text/javascript" src="https://cdn.mathjax.org/mathjax/latest/MathJax.js?config=TeX-AMS_CHTML-full,Safe&amp;delayStartupUntil=configured"></script>
 
     <script type="text/javascript" src="https://cdn.mathjax.org/mathjax/latest/MathJax.js?config=TeX-AMS_CHTML-full,Safe&amp;delayStartupUntil=configured"></script>
 
   </head>
 
   </head>
 
   <body>
 
   <body>
 
-    <script id='jupyter-config-data' type="application/json">{
 
-        "baseUrl": "{{base_url}}",
 
-        "token": "{{token}}"
 
-    }</script>
 
-    <script src="{{base_url}}example/bundle.js"></script>
 
+      {% set page_config_full = {'baseUrl': base_url, 'token': token} %}
 
+      
+        <script id="jupyter-config-data" type="application/json">
 
+          {{ page_config_full | tojson }}
 
+        </script>
 
+    <script src="{{base_url | e}}example/bundle.js"></script>
 
 
 
     <script type="text/javascript">
 
     <script type="text/javascript">
 
       /* Remove token from URL. */
 
       /* Remove token from URL. */

+ 7 - 5
examples/console/index.html
View File 

@@ -5,11 +5,13 @@
 
     <script type="text/javascript" src="https://cdn.mathjax.org/mathjax/latest/MathJax.js?config=TeX-AMS_CHTML-full,Safe&amp;delayStartupUntil=configured"></script>
 
     <script type="text/javascript" src="https://cdn.mathjax.org/mathjax/latest/MathJax.js?config=TeX-AMS_CHTML-full,Safe&amp;delayStartupUntil=configured"></script>
 
   </head>
 
   </head>
 
   <body>
 
   <body>
 
-    <script id='jupyter-config-data' type="application/json">{
 
-        "baseUrl": "{{base_url}}",
 
-        "token": "{{token}}"
 
-    }</script>
 
-    <script src="{{base_url}}example/bundle.js"></script>
 
+    {% set page_config_full = {'baseUrl': base_url, 'token': token} %}
 
+    
+    <script id="jupyter-config-data" type="application/json">
 
+      {{ page_config_full | tojson }}
 
+    </script>
 
+  
+    <script src="{{base_url | e}}example/bundle.js"></script>
 
 
 
     <script type="text/javascript">
 
     <script type="text/javascript">
 
       /* Remove token from URL. */
 
       /* Remove token from URL. */

+ 7 - 5
examples/filebrowser/index.html
View File 

@@ -4,11 +4,13 @@
 
     <title>FileBrowser Demo</title>
 
     <title>FileBrowser Demo</title>
 
   </head>
 
   </head>
 
   <body>
 
   <body>
 
-    <script id='jupyter-config-data' type="application/json">{
 
-        "baseUrl": "{{base_url}}",
 
-        "token": "{{token}}"
 
-    }</script>
 
-    <script src="{{base_url}}example/bundle.js"></script>
 
+    {% set page_config_full = {'baseUrl': base_url, 'token': token} %}
 
+    
+    <script id="jupyter-config-data" type="application/json">
 
+      {{ page_config_full | tojson }}
 
+    </script>
 
+  
+    <script src="{{base_url | e}}example/bundle.js"></script>
 
 
 
     <script type="text/javascript">
 
     <script type="text/javascript">
 
       /* Remove token from URL. */
 
       /* Remove token from URL. */

+ 1 - 1
examples/notebook/index.html
View File 

@@ -7,7 +7,7 @@
 
     <script id='jupyter-config-data' type="application/json">
 
     <script id='jupyter-config-data' type="application/json">
 
       {{ config_data|tojson }}
 
       {{ config_data|tojson }}
 
     </script>
 
     </script>
 
-    <script src="{{config_data['frontendUrl']}}bundle.js"></script>
 
+    <script src="{{config_data['frontendUrl'] | e}}bundle.js"></script>
 
 
 
     <script type="text/javascript">
 
     <script type="text/javascript">
 
       /* Remove token from URL. */
 
       /* Remove token from URL. */

+ 7 - 6
examples/terminal/index.html
View File 

@@ -4,12 +4,13 @@
 
     <title>Terminal Demo</title>
 
     <title>Terminal Demo</title>
 
   </head>
 
   </head>
 
   <body>
 
   <body>
 
-    <script id='jupyter-config-data' type="application/json">{
 
-      "baseUrl": "{{base_url}}",
 
-      "terminalsAvailable": "{{terminals_available}}",
 
-      "token": "{{token}}"
 
-    }</script>
 
-    <script src="{{base_url}}example/bundle.js"></script>
 
+    {% set page_config_full = {'baseUrl': base_url, 'token': token, 'terminalsAvailable': terminals_available} %}
 
+    
+    <script id="jupyter-config-data" type="application/json">
 
+      {{ page_config_full | tojson }}
 
+    </script>
 
+  
+    <script src="{{base_url | e}}example/bundle.js"></script>
 
 
 
     <script type="text/javascript">
 
     <script type="text/javascript">
 
       /* Remove token from URL. */
 
       /* Remove token from URL. */

+ 7 - 2
packages/services/examples/browser-require/index.html
View File 

@@ -10,7 +10,12 @@
 
     </style>
 
     </style>
 
   </head>
 
   </head>
 
   <body>
 
   <body>
 
-    <script id='jupyter-config-data' type="application/json">{ "baseUrl": "{{base_url}}" }</script>
 
+    {% set page_config_full = {'baseUrl': base_url} %}
 
+  
+    <script id="jupyter-config-data" type="application/json">
 
+      {{ page_config_full | tojson }}
 
+    </script>
 
+  
     <h1>Run code!</h1>
 
     <h1>Run code!</h1>
 
     <p>
 
     <p>
 
       Type code in the text area and click run to execute it.
 
       Type code in the text area and click run to execute it.
 
@@ -33,6 +38,6 @@
 
         }
 
         }
 
     });
 
     });
 
     </script>
 
     </script>
 
-    <script src="{{base_url}}example/index.js"></script>
 
+    <script src="{{base_url | e}}example/index.js"></script>
 
   </body>
 
   </body>
 
 </html>
 
 </html>

+ 7 - 2
packages/services/examples/browser/index.html
View File 

@@ -5,8 +5,13 @@
 
     <script src="https://cdnjs.cloudflare.com/ajax/libs/require.js/2.2.0/require.js"></script>
 
     <script src="https://cdnjs.cloudflare.com/ajax/libs/require.js/2.2.0/require.js"></script>
 
   </head>
 
   </head>
 
   <body>
 
   <body>
 
-    <script id='jupyter-config-data' type="application/json">{ "baseUrl": "{{base_url}}" }</script>
 
-    <script src="{{base_url}}example/bundle.js"></script>
 
+    {% set page_config_full = {'baseUrl': base_url} %}
 
+
 
+    <script id="jupyter-config-data" type="application/json">
 
+      {{ page_config_full | tojson }}
 
+    </script>
 
+  
+    <script src="{{base_url | e}}example/bundle.js"></script>
 
     <pre id='output'></pre>
 
     <pre id='output'></pre>
 
   </body>
 
   </body>
 
 </html>
 
 </html>

+ 7 - 2
packages/services/examples/typescript-browser-with-output/index.html
View File 

@@ -5,8 +5,13 @@
 
     <script src="https://cdnjs.cloudflare.com/ajax/libs/require.js/2.2.0/require.js"></script>
 
     <script src="https://cdnjs.cloudflare.com/ajax/libs/require.js/2.2.0/require.js"></script>
 
   </head>
 
   </head>
 
   <body>
 
   <body>
 
-    <script id='jupyter-config-data' type="application/json">{ "baseUrl": "{{base_url}}" }</script>
 
-    <script src="{{base_url}}example/bundle.js"></script>
 
+    {% set page_config_full = {'baseUrl': base_url} %}
 
+
 
+    <script id="jupyter-config-data" type="application/json">
 
+      {{ page_config_full | tojson }}
 
+    </script>
 
+
 
+    <script src="{{base_url | e}}example/bundle.js"></script>
 
     <span id='outputarea'></span>
 
     <span id='outputarea'></span>
 
   </body>
 
   </body>
 
 </html>
 
 </html>