DS: Open untrusted notebooks as readonly (#12579)

microsoft · Jun 29, 2020 · 2a1c244 · 2a1c244
1 parent 2960baf
commit 2a1c244
Show file tree

Hide file tree

Showing 12 changed files with 80 additions and 24 deletions.
diff --git a/src/datascience-ui/history-react/interactiveCell.tsx b/src/datascience-ui/history-react/interactiveCell.tsx
@@ -296,6 +296,7 @@ export class InteractiveCell extends React.Component<IInteractiveCellProps> {
                     codeVersion={this.props.cellVM.codeVersion ? this.props.cellVM.codeVersion : 0}
                     focusPending={this.props.focusPending}
                     language={this.props.language}
+                    isNotebookTrusted={true}
                 />
             );
         }

diff --git a/src/datascience-ui/interactive-common/cellInput.tsx b/src/datascience-ui/interactive-common/cellInput.tsx
@@ -30,6 +30,7 @@ interface ICellInputProps {
     showLineNumbers?: boolean;
     font: IFont;
     disableUndoStack: boolean;
+    isNotebookTrusted: boolean;
     /**
      * Only used in interactive window.
      */
@@ -101,7 +102,7 @@ export class CellInput extends React.Component<ICellInputProps> {
                         code={this.getRenderableInputCode()}
                         codeTheme={this.props.codeTheme}
                         testMode={this.props.testMode ? true : false}
-                        readOnly={!this.props.cellVM.editable}
+                        readOnly={!this.props.cellVM.editable || !this.props.isNotebookTrusted}
                         showWatermark={this.props.showWatermark}
                         ref={this.codeRef}
                         onChange={this.props.onCodeChange}
@@ -157,6 +158,7 @@ export class CellInput extends React.Component<ICellInputProps> {
                         font={this.props.font}
                         disableUndoStack={this.props.disableUndoStack}
                         version={this.props.codeVersion}
+                        isNotebookTrusted={this.props.isNotebookTrusted}
                     />
                 </div>
             );

diff --git a/src/datascience-ui/interactive-common/jupyterInfo.tsx b/src/datascience-ui/interactive-common/jupyterInfo.tsx
@@ -66,13 +66,15 @@ export class JupyterInfo extends React.Component<IJupyterInfoProps> {
     }
 
     private renderKernelStatus(displayNameTextWidth: React.CSSProperties) {
+        const ariaDisabled = this.props.isNotebookTrusted === undefined ? false : this.props.isNotebookTrusted;
         if (this.isKernelSelectionAllowed) {
             return (
                 <div
                     className="kernel-status-section kernel-status-section-hoverable kernel-status-status"
                     style={displayNameTextWidth}
                     onClick={this.selectKernel}
                     role="button"
+                    aria-disabled={ariaDisabled}
                 >
                     {this.props.kernel.displayName}: {this.props.kernel.jupyterServerStatus}
                 </div>
@@ -120,7 +122,9 @@ export class JupyterInfo extends React.Component<IJupyterInfoProps> {
     }
 
     private selectKernel() {
-        this.props.selectKernel();
+        if (this.props.isNotebookTrusted) {
+            this.props.selectKernel();
+        }
     }
     private getIcon(): ImageName {
         return this.props.kernel.jupyterServerStatus === ServerStatus.NotStarted

diff --git a/src/datascience-ui/interactive-common/markdown.tsx b/src/datascience-ui/interactive-common/markdown.tsx
@@ -24,6 +24,7 @@ export interface IMarkdownProps {
     hasFocus: boolean;
     cursorPos: CursorPos | monacoEditor.IPosition;
     disableUndoStack: boolean;
+    isNotebookTrusted: boolean;
     onCreated(code: string, modelId: string): void;
     onChange(e: IMonacoModelContentChangeEvent): void;
     focused?(): void;
@@ -46,7 +47,7 @@ export class Markdown extends React.Component<IMarkdownProps> {
             <div className={classes}>
                 <Editor
                     codeTheme={this.props.codeTheme}
-                    readOnly={false}
+                    readOnly={!this.props.isNotebookTrusted}
                     history={undefined}
                     onCreated={this.props.onCreated}
                     onChange={this.props.onChange}

diff --git a/src/datascience-ui/interactive-common/redux/reducers/transfer.ts b/src/datascience-ui/interactive-common/redux/reducers/transfer.ts
@@ -308,6 +308,10 @@ export namespace Transfer {
         postActionToExtension(arg, InteractiveWindowMessages.LoadAllCellsComplete, {
             cells: arg.prevState.cellVMs.map((c) => c.cell)
         });
+        if (!arg.prevState.isNotebookTrusted) {
+            // As soon as an untrusted notebook is loaded, prompt the user to trust it
+            postActionToExtension(arg, InteractiveWindowMessages.LaunchNotebookTrustPrompt);
+        }
         return arg.prevState;
     }
 }
diff --git a/src/datascience-ui/interactive-common/redux/store.ts b/src/datascience-ui/interactive-common/redux/store.ts
@@ -74,7 +74,7 @@ function generateDefaultState(
             },
             settings: testMode ? getDefaultSettings() : undefined, // When testing, we don't send (or wait) for the real settings.
             editorOptions: testMode ? computeEditorOptions(getDefaultSettings()) : undefined,
-            isNotebookTrusted: false
+            isNotebookTrusted: true
         };
     }
 }

diff --git a/src/datascience-ui/native-editor/addCellLine.tsx b/src/datascience-ui/native-editor/addCellLine.tsx
@@ -10,6 +10,7 @@ interface IAddCellLineProps {
     baseTheme: string;
     includePlus: boolean;
     className: string;
+    isNotebookTrusted: boolean;
     click(): void;
 }
 
@@ -30,6 +31,7 @@ export class AddCellLine extends React.Component<IAddCellLineProps> {
                     role="button"
                     aria-pressed="false"
                     title={tooltip}
+                    disabled={!this.props.isNotebookTrusted}
                     aria-label={tooltip}
                     className="add-cell-line-button"
                     onClick={this.props.click}

diff --git a/src/datascience-ui/native-editor/nativeCell.tsx b/src/datascience-ui/native-editor/nativeCell.tsx
@@ -133,6 +133,10 @@ export class NativeCell extends React.Component<INativeCellProps> {
         return this.props.cellVM.selected;
     };
 
+    private isNotebookTrusted = () => {
+        return this.props.isNotebookTrusted;
+    };
+
     private isFocused = () => {
         return this.props.cellVM.focused;
     };
@@ -142,8 +146,12 @@ export class NativeCell extends React.Component<INativeCellProps> {
     };
 
     private renderNormalCell() {
-        const cellOuterClass = this.props.cellVM.editable ? 'cell-outer-editable' : 'cell-outer';
-        let cellWrapperClass = this.props.cellVM.editable ? 'cell-wrapper' : 'cell-wrapper cell-wrapper-noneditable';
+        const cellOuterClass =
+            this.props.cellVM.editable && this.props.isNotebookTrusted ? 'cell-outer-editable' : 'cell-outer';
+        let cellWrapperClass =
+            this.props.cellVM.editable && this.props.isNotebookTrusted
+                ? 'cell-wrapper'
+                : 'cell-wrapper cell-wrapper-noneditable';
         if (this.isSelected() && !this.isFocused()) {
             cellWrapperClass += ' cell-wrapper-selected';
         }
@@ -152,7 +160,6 @@ export class NativeCell extends React.Component<INativeCellProps> {
         }
 
         // Content changes based on if a markdown cell or not.
-        // Make renderOutput() conditional on whether notebook is in trusted state
         const content =
             this.isMarkdownCell() && !this.isShowingMarkdownEditor() ? (
                 <div className="cell-result-container">
@@ -258,7 +265,7 @@ export class NativeCell extends React.Component<INativeCellProps> {
     };
 
     private shouldRenderOutput(): boolean {
-        if (this.isCodeCell()) {
+        if (this.isCodeCell() && this.props.isNotebookTrusted) {
             const cell = this.getCodeCell();
             return (
                 this.hasOutput() &&
@@ -268,13 +275,16 @@ export class NativeCell extends React.Component<INativeCellProps> {
                 cell.outputs.length !== 0
             );
         } else if (this.isMarkdownCell()) {
-            return !this.isShowingMarkdownEditor();
+            return !this.isShowingMarkdownEditor() && this.isNotebookTrusted();
         }
         return false;
     }
 
     // tslint:disable-next-line: cyclomatic-complexity max-func-body-length
     private keyDownInput = (cellId: string, e: IKeyboardEvent) => {
+        if (!this.isNotebookTrusted()) {
+            return; // Disable keyboard interaction with untrusted notebooks
+        }
         const isFocusedWhenNotSuggesting = this.isFocused() && e.editorInfo && !e.editorInfo.isSuggesting;
         switch (e.code) {
             case 'ArrowUp':
@@ -500,6 +510,7 @@ export class NativeCell extends React.Component<INativeCellProps> {
                 <ImageButton
                     baseTheme={this.props.baseTheme}
                     onClick={this.addNewCellBelow}
+                    disabled={!this.props.isNotebookTrusted}
                     tooltip={getLocString('DataScience.insertBelow', 'Insert cell below')}
                 >
                     <Image baseTheme={this.props.baseTheme} class="image-button-image" image={ImageName.InsertBelow} />
@@ -513,7 +524,7 @@ export class NativeCell extends React.Component<INativeCellProps> {
                     <ImageButton
                         baseTheme={this.props.baseTheme}
                         onClick={moveUp}
-                        disabled={this.props.firstCell}
+                        disabled={this.props.firstCell || !this.props.isNotebookTrusted}
                         tooltip={getLocString('DataScience.moveCellUp', 'Move cell up')}
                     >
                         <Image baseTheme={this.props.baseTheme} class="image-button-image" image={ImageName.Up} />
@@ -523,7 +534,7 @@ export class NativeCell extends React.Component<INativeCellProps> {
                     <ImageButton
                         baseTheme={this.props.baseTheme}
                         onClick={moveDown}
-                        disabled={this.props.lastCell}
+                        disabled={this.props.lastCell || !this.props.isNotebookTrusted}
                         tooltip={getLocString('DataScience.moveCellDown', 'Move cell down')}
                     >
                         <Image baseTheme={this.props.baseTheme} class="image-button-image" image={ImageName.Down} />
@@ -544,6 +555,7 @@ export class NativeCell extends React.Component<INativeCellProps> {
                         className="add-divider"
                         baseTheme={this.props.baseTheme}
                         includePlus={false}
+                        isNotebookTrusted={this.props.isNotebookTrusted}
                         click={this.addNewCell}
                     />
                 );
@@ -663,7 +675,7 @@ export class NativeCell extends React.Component<INativeCellProps> {
                         onClick={runCell}
                         tooltip={getLocString('DataScience.runCell', 'Run cell')}
                         hidden={this.isMarkdownCell()}
-                        disabled={this.props.busy}
+                        disabled={this.props.busy || !this.props.isNotebookTrusted}
                     >
                         <Image baseTheme={this.props.baseTheme} class="image-button-image" image={ImageName.Run} />
                     </ImageButton>
@@ -672,15 +684,20 @@ export class NativeCell extends React.Component<INativeCellProps> {
                         onClick={runbyline}
                         tooltip={getLocString('DataScience.runByLine', 'Run by line')}
                         hidden={this.isMarkdownCell() || !this.props.supportsRunByLine}
-                        disabled={this.props.busy}
+                        disabled={this.props.busy || !this.props.isNotebookTrusted}
                     >
                         <Image
                             baseTheme={this.props.baseTheme}
                             class="image-button-image"
                             image={ImageName.RunByLine}
                         />
                     </ImageButton>
-                    <ImageButton baseTheme={this.props.baseTheme} onMouseDown={switchCellType} tooltip={switchTooltip}>
+                    <ImageButton
+                        baseTheme={this.props.baseTheme}
+                        onMouseDown={switchCellType}
+                        tooltip={switchTooltip}
+                        disabled={!this.props.isNotebookTrusted}
+                    >
                         <Image baseTheme={this.props.baseTheme} class="image-button-image" image={otherCellImage} />
                     </ImageButton>
                     <ImageButton
@@ -691,6 +708,7 @@ export class NativeCell extends React.Component<INativeCellProps> {
                             'Gather the code required to generate this cell into a new notebook'
                         )}
                         hidden={gatherDisabled}
+                        disabled={!this.props.isNotebookTrusted}
                     >
                         <Image
                             baseTheme={this.props.baseTheme}
@@ -703,6 +721,7 @@ export class NativeCell extends React.Component<INativeCellProps> {
                         onClick={deleteCell}
                         tooltip={getLocString('DataScience.deleteCell', 'Delete cell')}
                         className="delete-cell-button hover-cell-button"
+                        disabled={!this.props.isNotebookTrusted}
                     >
                         <Image baseTheme={this.props.baseTheme} class="image-button-image" image={ImageName.Delete} />
                     </ImageButton>
@@ -763,6 +782,7 @@ export class NativeCell extends React.Component<INativeCellProps> {
                         codeVersion={this.props.cellVM.codeVersion ? this.props.cellVM.codeVersion : 1}
                         focusPending={this.props.focusPending}
                         language={this.props.language}
+                        isNotebookTrusted={this.props.isNotebookTrusted}
                     />
                 </div>
             );

diff --git a/src/datascience-ui/native-editor/nativeEditor.tsx b/src/datascience-ui/native-editor/nativeEditor.tsx
@@ -94,6 +94,7 @@ export class NativeEditor extends React.Component<INativeEditorProps> {
                     className="add-cell-line-top"
                     click={this.insertAboveFirst}
                     baseTheme={this.props.baseTheme}
+                    isNotebookTrusted={this.props.isNotebookTrusted}
                 />
             );
 
@@ -197,8 +198,15 @@ ${buildSettingsCss(this.props.settings)}`}</style>
         this.props.getVariableData(this.props.currentExecutionCount, startIndex, pageSize);
     };
 
+    private isNotebookTrusted = () => {
+        return this.props.isNotebookTrusted;
+    };
+
     // tslint:disable-next-line: cyclomatic-complexity
     private mainKeyDown = (event: KeyboardEvent) => {
+        if (!this.isNotebookTrusted()) {
+            return; // Disable keyboard interaction with untrusted notebooks
+        }
         // Handler for key down presses in the main panel
         switch (event.key) {
             // tslint:disable-next-line: no-suspicious-comment
@@ -309,6 +317,7 @@ ${buildSettingsCss(this.props.settings)}`}</style>
                     baseTheme={this.props.baseTheme}
                     className="add-cell-line-cell"
                     click={addNewCell}
+                    isNotebookTrusted={this.props.isNotebookTrusted}
                 />
             ) : null;
 

diff --git a/src/datascience-ui/native-editor/toolbar.tsx b/src/datascience-ui/native-editor/toolbar.tsx
@@ -129,7 +129,7 @@ export class Toolbar extends React.PureComponent<INativeEditorToolbarProps> {
                         <ImageButton
                             baseTheme={this.props.baseTheme}
                             onClick={runAll}
-                            disabled={this.props.busy}
+                            disabled={this.props.busy || !this.props.isNotebookTrusted}
                             className="native-button"
                             tooltip={getLocString('DataScience.runAll', 'Run All Cells')}
                         >
@@ -142,7 +142,7 @@ export class Toolbar extends React.PureComponent<INativeEditorToolbarProps> {
                         <ImageButton
                             baseTheme={this.props.baseTheme}
                             onClick={runAbove}
-                            disabled={!canRunAbove || this.props.busy}
+                            disabled={!canRunAbove || this.props.busy || !this.props.isNotebookTrusted}
                             className="native-button"
                             tooltip={getLocString('DataScience.runAbove', 'Run cells above')}
                         >
@@ -155,7 +155,7 @@ export class Toolbar extends React.PureComponent<INativeEditorToolbarProps> {
                         <ImageButton
                             baseTheme={this.props.baseTheme}
                             onClick={runBelow}
-                            disabled={!canRunBelow || this.props.busy}
+                            disabled={!canRunBelow || this.props.busy || !this.props.isNotebookTrusted}
                             className="native-button"
                             tooltip={getLocString('DataScience.runBelow', 'Run cell and below')}
                         >
@@ -168,7 +168,7 @@ export class Toolbar extends React.PureComponent<INativeEditorToolbarProps> {
                         <ImageButton
                             baseTheme={this.props.baseTheme}
                             onClick={this.props.restartKernel}
-                            disabled={!canRestartAndInterruptKernel}
+                            disabled={!canRestartAndInterruptKernel || !this.props.isNotebookTrusted}
                             className="native-button"
                             tooltip={getLocString('DataScience.restartServer', 'Restart IPython kernel')}
                         >
@@ -181,7 +181,7 @@ export class Toolbar extends React.PureComponent<INativeEditorToolbarProps> {
                         <ImageButton
                             baseTheme={this.props.baseTheme}
                             onClick={this.props.interruptKernel}
-                            disabled={!canRestartAndInterruptKernel}
+                            disabled={!canRestartAndInterruptKernel || !this.props.isNotebookTrusted}
                             className="native-button"
                             tooltip={getLocString('DataScience.interruptKernel', 'Interrupt IPython kernel')}
                         >
@@ -194,6 +194,7 @@ export class Toolbar extends React.PureComponent<INativeEditorToolbarProps> {
                         <ImageButton
                             baseTheme={this.props.baseTheme}
                             onClick={addCell}
+                            disabled={!this.props.isNotebookTrusted}
                             className="native-button"
                             tooltip={getLocString('DataScience.addNewCell', 'Insert cell')}
                         >
@@ -206,7 +207,7 @@ export class Toolbar extends React.PureComponent<INativeEditorToolbarProps> {
                         <ImageButton
                             baseTheme={this.props.baseTheme}
                             onClick={this.props.clearAllOutputs}
-                            disabled={!this.props.cellCount}
+                            disabled={!this.props.cellCount || !this.props.isNotebookTrusted}
                             className="native-button"
                             tooltip={getLocString('DataScience.clearAllOutput', 'Clear All Output')}
                         >
@@ -219,6 +220,7 @@ export class Toolbar extends React.PureComponent<INativeEditorToolbarProps> {
                         <ImageButton
                             baseTheme={this.props.baseTheme}
                             onClick={toggleVariableExplorer}
+                            disabled={!this.props.isNotebookTrusted}
                             className="native-button"
                             tooltip={variableExplorerTooltip}
                         >
@@ -231,7 +233,7 @@ export class Toolbar extends React.PureComponent<INativeEditorToolbarProps> {
                         <ImageButton
                             baseTheme={this.props.baseTheme}
                             onClick={save}
-                            disabled={!this.props.dirty}
+                            disabled={!this.props.dirty || !this.props.isNotebookTrusted}
                             className="native-button"
                             tooltip={getLocString('DataScience.save', 'Save File')}
                         >
@@ -244,7 +246,7 @@ export class Toolbar extends React.PureComponent<INativeEditorToolbarProps> {
                         <ImageButton
                             baseTheme={this.props.baseTheme}
                             onClick={this.props.exportAs}
-                            disabled={!this.props.cellCount || this.props.busy}
+                            disabled={!this.props.cellCount || this.props.busy || !this.props.isNotebookTrusted}
                             className="native-button"
                             tooltip={getLocString('DataScience.notebookExportAs', 'Export as')}
                         >