Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Allow links in rendered html content #5344

Open
jacobtolar opened this issue Apr 7, 2020 · 0 comments
Open

Allow links in rendered html content #5344

jacobtolar opened this issue Apr 7, 2020 · 0 comments

Comments

@jacobtolar
Copy link

When jupyter notebook renders html content, links don't work. This is unintuitive and confusing.

This is because of the strict sandbox/content security policy enabled on iframes.

See:

notebook/notebook/templates/view.html

Line 26 in 7de8df4

<iframe id="iframe" sandbox="allow-scripts" src="{{file_url}}"></iframe>

notebook/notebook/base/handlers.py

Lines 694 to 699 in 7de8df4

@property
def content_security_policy(self):
# In case we're serving HTML/SVG, confine any Javascript to a unique
# origin so it can't interact with the notebook server.
return super(AuthenticatedFileHandler, self).content_security_policy + \
"; sandbox allow-scripts"

I suggest expanding this to include at least allow-popups allow-popups-to-escape-sandbox (in both cases above) to make it possible for links to work. I am happy to send a PR if this is an acceptable solution.

Related issue with sandboxing: #3652

As an example, this link won't work (currently) when rendered by Jupyter. You'd have to explicitly open it in a new tab. (Of course, if target=_blank is missing, it doesn't work either).

<body>
        <a href="https://jupyter.org/" target="_blank">https://jupyter.org/</a>
</body>

With the changes suggested above, at least links targeting new windows will work.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@jacobtolar