File tree 3 files changed +5
-2
lines changed
share/jupyter/nbconvert/templates
3 files changed +5
-2
lines changed Original file line number Diff line number Diff line change 63
63
'get_metadata' : filters .get_metadata ,
64
64
'convert_pandoc' : filters .convert_pandoc ,
65
65
'json_dumps' : json .dumps ,
66
+ # browsers will parse </script>, closing a script tag early
67
+ # Since JSON allows escaping forward slash, this will still be parsed by JSON
68
+ 'escape_html_script' : lambda x : x .replace ('</script>' , '<\\ /script>' ),
66
69
'strip_trailing_newline' : filters .strip_trailing_newline ,
67
70
'text_base64' : filters .text_base64 ,
68
71
}
Original file line number Diff line number Diff line change @@ -267,7 +267,7 @@ var element = $('#{{ div_id }}');
267
267
{% set mimetype = 'application/vnd.jupyter.widget-state+json' %}
268
268
{% if mimetype in nb .metadata .get ("widgets" ,{})%}
269
269
<script type =" {{ mimetype }}" >
270
- {{ nb .metadata .widgets [mimetype] | json_dumps }}
270
+ {{ nb .metadata .widgets [mimetype] | json_dumps | escape_html_script }}
271
271
</script >
272
272
{% endif %}
273
273
{{ super() }}
Original file line number Diff line number Diff line change @@ -273,7 +273,7 @@ var element = document.getElementById('{{ div_id }}');
273
273
{% set mimetype = 'application/vnd.jupyter.widget-state+json' %}
274
274
{% if mimetype in nb .metadata .get ("widgets" ,{})%}
275
275
<script type =" {{ mimetype }}" >
276
- {{ nb .metadata .widgets [mimetype] | json_dumps }}
276
+ {{ nb .metadata .widgets [mimetype] | json_dumps | escape_html_script }}
277
277
</script >
278
278
{% endif %}
279
279
{{ super() }}
You can’t perform that action at this time.
0 commit comments