|
@@ -59,6 +59,10 @@ function renderHTML(options: renderHTML.IOptions): Promise<void> {
|
|
// Set the inner HTML of the host.
|
|
// Set the inner HTML of the host.
|
|
host.innerHTML = source;
|
|
host.innerHTML = source;
|
|
|
|
|
|
|
|
+ if (host.getElementsByTagName('script')) {
|
|
|
|
+ console.warn('JupyterLab does not render inline JavaScript in HTML output');
|
|
|
|
+ }
|
|
|
|
+
|
|
// TODO - arbitrary script execution is disabled for now.
|
|
// TODO - arbitrary script execution is disabled for now.
|
|
// Eval any script tags contained in the HTML. This is not done
|
|
// Eval any script tags contained in the HTML. This is not done
|
|
// automatically by the browser when script tags are created by
|
|
// automatically by the browser when script tags are created by
|
|
@@ -305,6 +309,10 @@ function renderMarkdown(options: renderMarkdown.IRenderOptions): Promise<void> {
|
|
// Set the inner HTML of the host.
|
|
// Set the inner HTML of the host.
|
|
host.innerHTML = content;
|
|
host.innerHTML = content;
|
|
|
|
|
|
|
|
+ if (host.getElementsByTagName('script')) {
|
|
|
|
+ console.warn('JupyterLab does not render inline JavaScript in HTML output');
|
|
|
|
+ }
|
|
|
|
+
|
|
// TODO arbitrary script execution is disabled for now.
|
|
// TODO arbitrary script execution is disabled for now.
|
|
// Eval any script tags contained in the HTML. This is not done
|
|
// Eval any script tags contained in the HTML. This is not done
|
|
// automatically by the browser when script tags are created by
|
|
// automatically by the browser when script tags are created by
|