Path: csiph.com!aioe.org!bofh.it!news.nic.it!robomod
From: Julien Puydt <julien.puydt@laposte.net>
Newsgroups: linux.debian.maint.python
Subject: Updating nbconvert : problems with privacy breaches
Date: Fri, 14 Sep 2018 21:20:01 +0200
Message-ID: <wy1Nf-3Rh-1@gated-at.bofh.it>
X-Mailbox-Line: From debian-python-request@lists.debian.org  Fri Sep 14 19:15:41 2018
Old-Return-Path: <julien.puydt@laposte.net>
X-Amavis-Spam-Status: No, score=-7.058 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, LDO_WHITELIST=-5, MURPHY_DRUGS_REL8=0.02, RCVD_IN_DNSWL_LOW=-0.7, SARE_FREE_WEBM_LAPOSTE=0.721] autolearn=ham autolearn_force=no
X-Policyd-Weight: using cached result; rate: -6.2
X-Greylist: delayed 1479 seconds by postgrey-1.36 at bendel; Fri, 14 Sep 2018 19:15:23 UTC
Dkim-Signature: v=1; a=rsa-sha256; c=simple/simple; d=laposte.net; s=mail0; t=1536951038; bh=A2KWH79J9c/EWrGPnQLySNZHguANXPA1SYuy1u2obwA=; h=From:Subject:To:Date; b=OTLqpyBKBhoIaihuqkA8/mFjUTX4njyTSYEnO3dvrggEKEGieY7n4P3QdC7L/aXER bkofSFRK9IrWecjV4h03Hf3MHP4dED1OdajmeQTnMKGvqRZPD6jLZh9lOI9KuSe3B5 K/5QbBfAiQdDGjEAAEUZsUoVFiUtNlcBTEUjuAHVKCttyoQD1aREwSSkLJlbbC8D7z 6Re6ti+R6iuEERILUPtzkoI//EE4kfer+7vSESagkJJjaHRHXnylEoxxFMRcjTNM04 00pebVkEt+UxP7Ls24p4xyo1oBusxXx+veKyNvUBSHJlc/lJ5K+zleA5u9n2awZkhv OSfqOHieILHmA==
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.0
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: fr
Content-Transfer-Encoding: 8bit
X-Vr-Cause-1: gggruggvucftvghtrhhoucdtuddrgedtjedrjeekgdduvdegucetufdoteggodetrfdotffvucfrrhho
X-Vr-Cause-2: fhhilhgvmecunfetrffquffvgfenuceurghilhhouhhtmecuhedttdenucenucfjughrpefhuffvkfff
X-Vr-Cause-3: fgggtgfgsehtkeertddtfeejnecuhfhrohhmpefluhhlihgvnhcurfhuhiguthcuoehjuhhlihgvnhdr
X-Vr-Cause-4: phhuhigutheslhgrphhoshhtvgdrnhgvtheqnecuffhomhgrihhnpeguvggsihgrnhdrohhrghdptghl
X-Vr-Cause-5: ohhuughflhgrrhgvrdgtohhmnecukfhppeekvddrvdefiedrudegledriedvnecurfgrrhgrmhepmhho
X-Vr-Cause-6: uggvpehsmhhtphhouhhtpdhinhgvthepkedvrddvfeeirddugeelrdeivddphhgvlhhopegludelvddr
X-Vr-Cause-7: udeikedruddrhegnpdhmrghilhhfrhhomhepjhhulhhivghnrdhpuhihughtsehlrghpohhsthgvrdhn
X-Vr-Cause-8: vghtpdhrtghpthhtohepuggvsghirghnqdhphihthhhonheslhhishhtshdruggvsghirghnrdhorhhg
X-Vr-Cause-9: necuvehluhhsthgvrhfuihiivgeptd
X-Vr-Avstate: No
X-Mailing-List: <debian-python@lists.debian.org> archive/latest/16324
List-ID: <debian-python.lists.debian.org>
List-URL: <https://lists.debian.org/debian-python/>
List-Archive: https://lists.debian.org/msgid-search/88a99a9c-ab44-2a7b-4f99-fde91c42cfac@laposte.net
Approved: robomod@news.nic.it
Lines: 63
Organization: linux.* mail to news gateway
Sender: robomod@news.nic.it
X-Original-Date: Fri, 14 Sep 2018 20:50:37 +0200
X-Original-Message-ID: <88a99a9c-ab44-2a7b-4f99-fde91c42cfac@laposte.net>
Xref: csiph.com linux.debian.maint.python:10897

Hi,

looking into finishing packaging nbconvert's latest version (thanks 
Ondřej Nový and Gordon Ball for the help!), lintian had quite a few 
complaints about privacy breaches:

W: python-nbconvert-doc: privacy-breach-generic 
usr/share/doc/python-nbconvert-doc/html/customizing.html [<script 
src="https://cdnjs.cloudflare.com/ajax/libs/require.js/2.1.10/require.min.js">] 
(https://cdnjs.cloudflare.com/ajax/libs/require.js/2.1.10/require.min.js)
E: python-nbconvert-doc: privacy-breach-uses-embedded-file 
usr/share/doc/python-nbconvert-doc/html/customizing.html You may use the 
libjs-jquery package. 
(https://cdnjs.cloudflare.com/ajax/libs/jquery/2.0.3/jquery.min.js)
E: python-nbconvert-doc: privacy-breach-uses-embedded-file 
usr/share/doc/python-nbconvert-doc/html/customizing.html You may use the 
libjs-mathjax package. 
(https://cdnjs.cloudflare.com/ajax/libs/mathjax/2.7.1/mathjax.js?config=tex-ams_html)


And indeed grepping the source code, there are a few places with links 
to cloudflare.com :

./docs/source/customizing.ipynb:    "    <script 
src=\"https://cdnjs.cloudflare.com/ajax/libs/mathjax/2.7.0/MathJax.js?config=TeX-AMS_HTML\"></script>\n",
./nbconvert/postprocessors/serve.py:    reveal_cdn = 
Unicode("https://cdnjs.cloudflare.com/ajax/libs/reveal.js/3.5.0",
./nbconvert/exporters/slides.py:        return 
'https://cdnjs.cloudflare.com/ajax/libs/reveal.js/3.5.0'
./nbconvert/exporters/slides.py: 
"https://cdnjs.cloudflare.com/ajax/libs/require.js/2.1.10/require.min.js",
./nbconvert/exporters/slides.py: 
"https://cdnjs.cloudflare.com/ajax/libs/jquery/2.0.3/jquery.min.js",
./nbconvert/exporters/slides.py: 
"https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css",
./nbconvert/templates/html/full.tpl:<script 
src="https://cdnjs.cloudflare.com/ajax/libs/require.js/2.1.10/require.min.js"></script>
./nbconvert/templates/html/full.tpl:<script 
src="https://cdnjs.cloudflare.com/ajax/libs/jquery/2.0.3/jquery.min.js"></script>
./nbconvert/templates/html/mathjax.tpl:{%- macro 
mathjax(url='https://cdnjs.cloudflare.com/ajax/libs/mathjax/2.7.1/MathJax.js?config=TeX-AMS_HTML') 
-%}

Touching docs/source/customizing.ipynb to patch out cloudflare links 
should be ok : it's the source of customizing.html, which ends up in 
python-nbconvert-doc and is directly used on a Debian system. I don't 
break anything by patching it.

But the other files... it's about changing the exporters and templates 
during document generation ; and the resulting files might then get used 
on non-Debian systems. In short : if I tamper with them to use Debian 
local packages, that basically means nbconvert in Debian will produce 
broken documents.

Perhaps patching customizing.html after it was built (using sed 
magic...) is an acceptable solution?

Since I don't feel sure about my course of action, I thought it would be 
better to ask for advice and ideas here.

Cheers,

jpuydt on irc.debian.org