nbconvert/exporters/tests/files/notebook_inject.ipynb

{
 "cells": [
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "79aede83-fba6-4715-bce6-9f3926b128a2",
   "metadata": {
     "tags": ["FOO\"><script>alert('cell_tag')</script><div \""]
   },
   "outputs": [],
   "source": []
  },
  {
    "cell_type": "raw",
    "id": "372c2bf1",
    "metadata": {},
    "source": [
     "Payload in raw cell <script>alert('raw cell')</script>"
    ]
  },
  {
    "cell_type": "markdown",
    "id": "2d42de4a",
    "metadata": {},
    "source": [
      "<script>alert('markdown cell')</script>"
    ]
  },
  {
    "cell_type": "code",
    "execution_count": null,
    "id": "b72e53fa",
    "metadata": {},
    "outputs": [
      {
        "output_type": "execute_result",
        "data": {
          "image/svg+xml": ["<script>alert('image/svg+xml output')</script>"]
        },
        "execution_count": null,
        "metadata": {}
      }
    ],
    "source": [""]
   },
   {
    "cell_type": "code",
    "execution_count": null,
    "id": "64d5d39f",
    "metadata": {},
    "outputs": [
      {
        "output_type": "execute_result",
        "svg_filename": "\"><script>alert('svg_filename')</script>",
        "data": {
          "image/svg+xml": [""]
        },
        "execution_count": null,
        "metadata": {}
      }
    ],
    "source": [""]
   },
   {
    "cell_type": "code",
    "execution_count": null,
    "id": "b72e63fa",
    "metadata": {},
    "outputs": [
      {
        "output_type": "execute_result",
        "data": {
          "image/png": [""]
        },
        "execution_count": null,
        "metadata": {
          "filenames": {
              "image/png": "\"><script>alert('png filenames')</script>"
          }
        }
      }
    ],
    "source": [""]
   },
   {
    "cell_type": "code",
    "execution_count": null,
    "id": "b72e63f3",
    "metadata": {},
    "outputs": [
      {
        "output_type": "execute_result",
        "data": {
          "image/jpeg": [""]
        },
        "execution_count": null,
        "metadata": {
          "filenames": {
              "image/jpeg": "\"><script>alert('jpg filenames')</script>"
          }
        }
      }
    ],
    "source": [""]
   },
   {
    "cell_type": "code",
    "execution_count": null,
    "id": "b72e635a",
    "metadata": {},
    "outputs": [
      {
        "output_type": "execute_result",
        "data": {
          "image/png": ["\"><script>alert('image/png output')</script>"]
        },
        "execution_count": null,
        "metadata": {}
      }
    ],
    "source": [""]
   },
   {
    "cell_type": "code",
    "execution_count": null,
    "id": "p72e635a",
    "metadata": {},
    "outputs": [
      {
        "output_type": "execute_result",
        "data": {
          "image/jpeg": ["\"><script>alert('image/jpeg output')</script>"]
        },
        "execution_count": null,
        "metadata": {}
      }
    ],
    "source": [""]
   },
   {
    "cell_type": "code",
    "execution_count": null,
    "id": "d72e635a",
    "metadata": {},
    "outputs": [
      {
        "output_type": "execute_result",
        "data": {
         "image/png": ["abcd"]
        },
        "execution_count": null,
        "metadata": {
           "width": "><script>alert('output.metadata.width png injection')</script>"
        }
      }
    ],
    "source": [""]
   },
   {
    "cell_type": "code",
    "execution_count": null,
    "id": "ae4f574d",
    "metadata": {},
    "outputs": [
      {
        "output_type": "execute_result",
        "data": {
         "image/png": ["abcd"]
        },
        "execution_count": null,
        "metadata": {
           "height": "><script>alert('output.metadata.height png injection')</script>"
        }
      }
    ],
    "source": [""]
   },
   {
    "cell_type": "code",
    "execution_count": null,
    "id": "w72e635a",
    "metadata": {},
    "outputs": [
      {
        "output_type": "execute_result",
        "data": {
         "application/vnd.jupyter.widget-view+json": {"model_id": "wid1", "foo": "\"</script><script>alert('output.data.application/vnd.jupyter.widget-view+json injection')//"}
        },
        "execution_count": null,
        "metadata": {}
       }
    ],
    "source": [""]
   },
   {
    "cell_type": "code",
    "execution_count": 5,
    "id": "2616e107",
    "metadata": {},
    "outputs": [
     {
      "data": {
       "text/html": [
         "<script>alert('text/html output')</script>"
       ]
      },
      "execution_count": 5,
      "metadata": {},
      "output_type": "execute_result"
     }
    ],
    "source": [
     "import os; os.system('touch /tmp/pwned')"
    ]
   },
   {
    "cell_type": "code",
    "execution_count": 5,
    "id": "3616e107",
    "metadata": {},
    "outputs": [
     {
      "data": {
       "text/markdown": [
         "<script>alert('text/markdown output')</script>"
       ]
      },
      "execution_count": 5,
      "metadata": {},
      "output_type": "execute_result"
     }
    ],
    "source": [
     "import os; os.system('touch /tmp/pwned')"
    ]
   },
   {
    "cell_type": "code",
    "execution_count": 5,
    "id": "4616e107",
    "metadata": {},
    "outputs": [
     {
      "data": {
       "application/javascript": [
         "alert('application/javascript output')"
       ]
      },
      "execution_count": 5,
      "metadata": {},
      "output_type": "execute_result"
     }
    ],
    "source": [
     "import os; os.system('touch /tmp/pwned')"
    ]
   }
 ],
 "metadata": {
  "title": "TITLE</title><script>alert('title')</script>",
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.10.5"
  },
  "widgets": {
    "application/vnd.jupyter.widget-state+json": {"state": {"wid1": {}}, "foo": "pwntester</script><script>alert('widgets');//"}
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}