Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

cythonmagic jupyterlab compatibility #1775

Closed
akhmerov opened this issue Jul 17, 2017 · 8 comments
Closed

cythonmagic jupyterlab compatibility #1775

akhmerov opened this issue Jul 17, 2017 · 8 comments

Comments

@akhmerov
Copy link

Due to jQuery not being defined in jupyterlab, the %%cython magic is unable to show interactive html when invoked inside jupyterlab. See also jupyterlab#2634.

@scoder
Copy link
Contributor

scoder commented Jul 17, 2017

I'd be happy to see a pull request by someone who understands (a bit) how jupyterlab wants these things to work. The code isn't complex, it's not using jQuery, and it's right here:

_js = """
function toggleDiv(id) {
theDiv = id.nextElementSibling
if (theDiv.style.display != 'block') theDiv.style.display = 'block';
else theDiv.style.display = 'none';
}
""".strip()

@tdamsma
Copy link
Contributor

tdamsma commented Mar 2, 2018

While investigating this I stumbled upon this related issue: jupyterlab/jupyterlab#2710:

Bokeh is inlining a <script> tag in its HTML output. We disallow arbitrary script execution in outputs in JLab because it's a huge security risk and the JLab extension system makes it easier to build Javascript viewers for things in a safer fashion.

I think the same is going on for the cython extension. The toggleDiv function is defined in the annotate code, and therefore only loaded after a cell is annotated. The function should instead be loaded when the extension is loaded, so I think it should be moved to https://github.com/cython/cython/blob/master/Cython/Build/IpythonMagic.py

@scoder
Copy link
Contributor

scoder commented Mar 2, 2018

Thanks for digging that out. It shouldn't be moved there because it actually belongs to Annotate.py, but reusing it from IPythonMagic.py sounds good. Pull request welcome.

@akhmerov
Copy link
Author

akhmerov commented Mar 2, 2018

IIRC I opened the issue before jupyterlab disabled arbitrary js execution. I believe right now the only way to render html output with javascript is to either write a jupyterlab extension or to use an existing one if it exists.

@tdamsma
Copy link
Contributor

tdamsma commented Mar 2, 2018

Ok, think I figured this out. The following works in a jupyterlab notebook:

from IPython.core.magic import Magics, magics_class, line_magic
from IPython.display import display, HTML
toggleDiv = """
this.nextElementSibling.style.display != 'block' ? 
this.nextElementSibling.style.display = 'block' : 
this.nextElementSibling.style.display = 'none'
"""

HTML(f"""
    <button onClick="{toggleDiv}">Click</button>
    <div style='display=none'>ok</div>""")

The workaround is inlining the toggleDiv in the html, and not using the scripttag. Come to think of it, isn't this just as much of a security issue as allowing js scripts?

@afshin
Copy link

afshin commented Mar 2, 2018

I agree, this appears to be a bug. I've created this issue: jupyterlab/jupyterlab#4091

Thanks!

This was referenced Mar 2, 2018
@tdamsma
Copy link
Contributor

tdamsma commented Mar 6, 2018

@scoder, could you review the PR, or do you want to wait for the JupyterLab discussion on if this should actually be allowed in the first place?

@scoder
Copy link
Contributor

scoder commented Mar 6, 2018

Thanks for the PR. It doesn't really hurt to do it that way, and if it helps for now, then why not. I'll also close the ticket. Please reopen if jupyterlab/jupyterlab#4091 comes to a decision that breaks this again.

@scoder scoder closed this as completed Mar 6, 2018
@scoder scoder added this to the 0.28 milestone Mar 6, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

4 participants