Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.maint.python > #10897 > unrolled thread

Updating nbconvert : problems with privacy breaches

Back to article view | Back to linux.debian.maint.python

Contents

  Updating nbconvert : problems with privacy breaches Julien Puydt <julien.puydt@laposte.net> - 2018-09-14 21:20 +0200
    Re: Updating nbconvert : problems with privacy breaches Diane Trout <diane@ghic.org> - 2018-09-15 07:40 +0200
      Re: Updating nbconvert : problems with privacy breaches Julien Puydt <julien.puydt@laposte.net> - 2018-09-29 16:10 +0200

#10897 — Updating nbconvert : problems with privacy breaches

Hi,

looking into finishing packaging nbconvert's latest version (thanks 
Ondřej Nový and Gordon Ball for the help!), lintian had quite a few 
complaints about privacy breaches:

W: python-nbconvert-doc: privacy-breach-generic 
usr/share/doc/python-nbconvert-doc/html/customizing.html [<script 
src="https://cdnjs.cloudflare.com/ajax/libs/require.js/2.1.10/require.min.js">] 
(https://cdnjs.cloudflare.com/ajax/libs/require.js/2.1.10/require.min.js)
E: python-nbconvert-doc: privacy-breach-uses-embedded-file 
usr/share/doc/python-nbconvert-doc/html/customizing.html You may use the 
libjs-jquery package. 
(https://cdnjs.cloudflare.com/ajax/libs/jquery/2.0.3/jquery.min.js)
E: python-nbconvert-doc: privacy-breach-uses-embedded-file 
usr/share/doc/python-nbconvert-doc/html/customizing.html You may use the 
libjs-mathjax package. 
(https://cdnjs.cloudflare.com/ajax/libs/mathjax/2.7.1/mathjax.js?config=tex-ams_html)


And indeed grepping the source code, there are a few places with links 
to cloudflare.com :

./docs/source/customizing.ipynb:    "    <script 
src=\"https://cdnjs.cloudflare.com/ajax/libs/mathjax/2.7.0/MathJax.js?config=TeX-AMS_HTML\"></script>\n",
./nbconvert/postprocessors/serve.py:    reveal_cdn = 
Unicode("https://cdnjs.cloudflare.com/ajax/libs/reveal.js/3.5.0",
./nbconvert/exporters/slides.py:        return 
'https://cdnjs.cloudflare.com/ajax/libs/reveal.js/3.5.0'
./nbconvert/exporters/slides.py: 
"https://cdnjs.cloudflare.com/ajax/libs/require.js/2.1.10/require.min.js",
./nbconvert/exporters/slides.py: 
"https://cdnjs.cloudflare.com/ajax/libs/jquery/2.0.3/jquery.min.js",
./nbconvert/exporters/slides.py: 
"https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css",
./nbconvert/templates/html/full.tpl:<script 
src="https://cdnjs.cloudflare.com/ajax/libs/require.js/2.1.10/require.min.js"></script>
./nbconvert/templates/html/full.tpl:<script 
src="https://cdnjs.cloudflare.com/ajax/libs/jquery/2.0.3/jquery.min.js"></script>
./nbconvert/templates/html/mathjax.tpl:{%- macro 
mathjax(url='https://cdnjs.cloudflare.com/ajax/libs/mathjax/2.7.1/MathJax.js?config=TeX-AMS_HTML') 
-%}

Touching docs/source/customizing.ipynb to patch out cloudflare links 
should be ok : it's the source of customizing.html, which ends up in 
python-nbconvert-doc and is directly used on a Debian system. I don't 
break anything by patching it.

But the other files... it's about changing the exporters and templates 
during document generation ; and the resulting files might then get used 
on non-Debian systems. In short : if I tamper with them to use Debian 
local packages, that basically means nbconvert in Debian will produce 
broken documents.

Perhaps patching customizing.html after it was built (using sed 
magic...) is an acceptable solution?

Since I don't feel sure about my course of action, I thought it would be 
better to ask for advice and ideas here.

Cheers,

jpuydt on irc.debian.org

[toc] | [next] | [standalone]

#10898

[Multipart message — attachments visible in raw view] — view raw

> But the other files... it's about changing the exporters and
> templates 
> during document generation ; and the resulting files might then get
> used 
> on non-Debian systems. In short : if I tamper with them to use
> Debian 
> local packages, that basically means nbconvert in Debian will
> produce 
> broken documents.
> 
> Perhaps patching customizing.html after it was built (using sed 
> magic...) is an acceptable solution?
> 
> Since I don't feel sure about my course of action, I thought it would
> be 
> better to ask for advice and ideas here.

I wonder if it'd be possible to get upstream to support picking where
to load resources from?

Bokeh has some options to pick loading resources between local or the
CDN. https://bokeh.pydata.org/en/latest/docs/reference/resources.html

[toc] | [prev] | [next] | [standalone]

#10953

Hi,

Le 15/09/2018 à 07:34, Diane Trout a écrit :
>  
> I wonder if it'd be possible to get upstream to support picking where
> to load resources from?

indeed asking upstream seems the best course of action:

https://github.com/jupyter/nbconvert/issues/890

jpuydt on irc.debian.org

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.maint.python

csiph-web