Skip to content

plots: fix wrong link #6693

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Oct 11, 2021
Merged

plots: fix wrong link #6693

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions dvc/render/image.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,15 +30,14 @@ def _write_image(
img_path = os.path.join(
static, f"{revision}_{filename.replace(os.sep, '_')}"
)
rel_img_path = relpath(img_path, page_dir_path)
with open(img_path, "wb") as fd:
fd.write(image_data)
return """
<div>
<p>{title}</p>
<img src="{src}">
</div>""".format(
title=revision, src=rel_img_path
title=revision, src=(relpath(img_path, page_dir_path))
Comment on lines 38 to +40
Copy link
Contributor

@jorgeorpinel jorgeorpinel Sep 28, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure what this refactoring does 😋

My feedback (#6431 (review)) was that you could inject HTML code via revision, which is a CLI input I think (can be any string). Of course it get's prepended with static/ so maybe that neutralizes any script, not sure.

Still the best practice would be to validate the input or at least sanitize the HTML output? Or maybe I'm exaggerating here.

Copy link
Contributor Author

@pared pared Sep 30, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jorgeorpinel I am not sure I understand. Do you mean to pass some HTML via revision CLI argument? What would this HTML be and what would be its purpose?

Copy link
Contributor

@jorgeorpinel jorgeorpinel Oct 5, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry for the delay @pared .

Do you mean to pass some HTML via revision CLI argument?

Yes. Well, probably JS mainly.

What would this HTML be and what would be its purpose?

A malicious <script>.

Copy link
Contributor Author

@pared pared Oct 6, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok, so in the beginning, I did not understand the problem. Hmm, it seems that you are right here.

On the other hand, I think that if one is able to use dvc plots show, he/she can edit the webpage in-place (since they have write permission anyway), so the modification can be done without help of DVC.

Copy link
Contributor

@jorgeorpinel jorgeorpinel Oct 11, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK @pared ! Up to you

)

def _convert(self, path: "StrPath"):
Expand Down
2 changes: 1 addition & 1 deletion dvc/render/vega.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ class PlotDataStructureError(DvcException):
def __init__(self):
super().__init__(
"Plot data extraction failed. Please see "
"https://man.dvc.org/plot for supported data formats."
"https://man.dvc.org/plots for supported data formats."
)


Expand Down