github-starred/gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-07-15 20:09:18 -05:00
Code Issues 2.6k Packages Projects Releases 100 Wiki Activity

Client side rendering of .ipynb has not been ported from gogs #1414

New Issue
Closed
opened 2025-11-02 04:00:05 -06:00 by GiteaMirror · 13 comments
GiteaMirror commented 2025-11-02 04:00:05 -06:00
Owner
Copy Link

Originally created by @memetb on GitHub (Jan 1, 2018).

Description

The client-side notebook preview functionality has not been backported from the original gogs repo.

https://try.gogs.io/niklas/ipynb-test/src/master/README.ipynb
https://try.gitea.io/memetb/test-ipynb/src/branch/master/Untitled.ipynb

Issue #3025 mentions using RENDER_COMMAND = jupyter nbconvert --to html --stdin --stdout however, there are multiple reasons why this can be problematic:

  • server side-rendering of jupyter notebooks requires the installation of anaconda. This defeats the purpose of having a lightweight executable that can be deployed on a raspberry pi.
  • executing jupyter on large notebooks is slow.
  • having to execute a python interpreter on user data is not safe and would require chrooting the whole thing if a sys-admin needs to be thorough.
Originally created by @memetb on GitHub (Jan 1, 2018). ## Description The client-side notebook preview functionality has not been backported from the original gogs repo. https://try.gogs.io/niklas/ipynb-test/src/master/README.ipynb https://try.gitea.io/memetb/test-ipynb/src/branch/master/Untitled.ipynb Issue #3025 mentions using `RENDER_COMMAND = jupyter nbconvert --to html --stdin --stdout` however, there are multiple reasons why this can be problematic: - server side-rendering of jupyter notebooks requires the installation of anaconda. This defeats the purpose of having a lightweight executable that can be deployed on a raspberry pi. - executing jupyter on large notebooks is slow. - having to execute a python interpreter on user data is not safe and would require chrooting the whole thing if a sys-admin needs to be thorough.
GiteaMirror added the type/proposal label 2025-11-02 04:00:05 -06:00
GiteaMirror commented 2025-11-02 04:00:06 -06:00
Author
Owner
Copy Link

@thehowl commented on GitHub (Jan 1, 2018):

Gogs uses notebookjs for displaying jupyter notebooks. I still need to research whether notebookjs allows the execution of arbitrary code (like JS code), and in the case it does, it's a no-go and we should instead consider making (or finding) a parser that only displays markup and does not run any user code.

@thehowl commented on GitHub (Jan 1, 2018): Gogs uses [notebookjs](https://github.com/jsvine/notebookjs) for displaying jupyter notebooks. I still need to research whether notebookjs allows the execution of arbitrary code (like JS code), and in the case it does, it's a no-go and we should instead consider making (or finding) a parser that only displays markup and does not run any user code.
GiteaMirror commented 2025-11-02 04:00:06 -06:00
Author
Owner
Copy Link

@memetb commented on GitHub (Jan 1, 2018):

Ok, I've uploaded a version of the notebook with javascript and style sheet injection. The quick answer is that, as configured, it does allow for execution of code. However, this doesn't constitute an audit of the code, perhaps there's a way to disable it.

https://try.gitea.io/memetb/test-ipynb/src/branch/master/Untitled.ipynb
https://try.gogs.io/testbbar/test-ipynb/src/master/Untitled.ipynb

Looking at nbpreview which makes use of notebookjs, I can see that it's possible to remove js. Although I'm not yet sure how it's being done.

@memetb commented on GitHub (Jan 1, 2018): Ok, I've uploaded a version of the notebook with javascript and style sheet injection. The quick answer is that, as configured, it does allow for execution of code. However, this doesn't constitute an audit of the code, perhaps there's a way to disable it. https://try.gitea.io/memetb/test-ipynb/src/branch/master/Untitled.ipynb https://try.gogs.io/testbbar/test-ipynb/src/master/Untitled.ipynb Looking at [nbpreview](https://jsvine.github.io/nbpreview/) which makes use of notebookjs, I can see that it's possible to remove js. Although I'm not yet sure how it's being done.
GiteaMirror commented 2025-11-02 04:00:06 -06:00
Author
Owner
Copy Link

@thehowl commented on GitHub (Jan 1, 2018):

Yeah, it seems like code generated from notebookjs should be run through an HTML cleaner/purifier/sanitizer first.

@thehowl commented on GitHub (Jan 1, 2018): Yeah, it seems like code generated from notebookjs should be run through an HTML cleaner/purifier/sanitizer first.
GiteaMirror commented 2025-11-02 04:00:06 -06:00
Author
Owner
Copy Link

@memetb commented on GitHub (Jan 1, 2018):

nbpreview is doing something to this effect. The thing works as a standalone html file, so there may be client side library parameters which allow for this.

Either that or it's buggy and not behaving the way it wants to.

@memetb commented on GitHub (Jan 1, 2018): nbpreview is doing something to this effect. The thing works as a standalone html file, so there may be client side library parameters which allow for this. Either that or it's buggy and not behaving the way it wants to.
GiteaMirror commented 2025-11-02 04:00:06 -06:00
Author
Owner
Copy Link

@memetb commented on GitHub (Jan 1, 2018):

Further info:

This is the feature being proposed on gogs.

It fails if I put javascript in the dom events. You're right, a server side javascript filter will likely be necessary.

nbviewer seems to do what we're wanting. (Other link leads to a broken preview).

To test it, just download the ipynb from the above repos and drag and drop.

Fyi, I've attached what the original file looks like (fwiw, none of the three previews so far have rendered the style sheet - which isn't necessarily a bad thing)
screenshot-2018-1-1 untitled

@memetb commented on GitHub (Jan 1, 2018): Further info: This is the feature [being proposed](https://github.com/gogits/gogs/issues/3715) on gogs. It fails if I put javascript in the dom events. You're right, a server side javascript filter will likely be necessary. ~~[nbviewer](https://kokes.github.io/nbviewer.js/viewer.html) seems to do what we're wanting. (Other link leads to a broken preview).~~ ~~To test it, just download the ipynb from the above repos and drag and drop.~~ ~~Fyi, I've attached what the original file looks like (fwiw, none of the three previews so far have rendered the style sheet - which isn't necessarily a bad thing)~~ ![screenshot-2018-1-1 untitled](https://user-images.githubusercontent.com/9244085/34467656-f759fbfc-ef4b-11e7-834c-f8d9109cb8fb.png)
GiteaMirror commented 2025-11-02 04:00:06 -06:00
Author
Owner
Copy Link

@memetb commented on GitHub (Jan 1, 2018):

It would seem jupyter themselves (c.f. page 34) advocate for the use of Google Caja. So far, from my searching, I haven't found any other library which does what Caja claims to do.

It would also appear caja has a standalone js sanitizer.

Let me know if you require further research.

@memetb commented on GitHub (Jan 1, 2018): It would seem [jupyter themselves](https://media.readthedocs.org/pdf/testnb/latest/testnb.pdf) (c.f. page 34) advocate for the use of [Google Caja](https://github.com/google/caja). So far, from my searching, I haven't found any other library which does what Caja claims to do. It would also appear caja has a [standalone js sanitizer](https://github.com/google/caja/wiki/JsHtmlSanitizer). Let me know if you require further research.
GiteaMirror commented 2025-11-02 04:00:07 -06:00
Author
Owner
Copy Link

@lstolcman commented on GitHub (May 14, 2018):

@memetb Could you share your config for rendering jupyter notebook files?

@lstolcman commented on GitHub (May 14, 2018): @memetb Could you share your config for rendering jupyter notebook files?
GiteaMirror commented 2025-11-02 04:00:07 -06:00
Author
Owner
Copy Link

@memetb commented on GitHub (May 19, 2018):

@lstolcman I'm not sure what you're asking for. Do you mean standalone? I'm using a standard out of the box anaconda installation, if that's what you mean.

@memetb commented on GitHub (May 19, 2018): @lstolcman I'm not sure what you're asking for. Do you mean standalone? I'm using a standard out of the box anaconda installation, if that's what you mean.
GiteaMirror commented 2025-11-02 04:00:07 -06:00
Author
Owner
Copy Link

@amit-pimco commented on GitHub (Sep 26, 2018):

is it planned yet ? It was working on gogs. I had migrated to gitea and ipynb rendering stopped working.

@amit-pimco commented on GitHub (Sep 26, 2018): is it planned yet ? It was working on gogs. I had migrated to gitea and ipynb rendering stopped working.
GiteaMirror commented 2025-11-02 04:00:07 -06:00
Author
Owner
Copy Link

@pavilo commented on GitHub (Nov 23, 2018):

It would be relatively easy to add ipynb support through an external markup renderer (e.g. using jupyter nbconvert) when #3025 is resolved.
A vanilla version would call the command every time the notebook has to be rendered. Next (and very reasonable) step would be to cache the rendered file until the source file is changed (e.g. scoping the cache to the source file hash). I think the approach is valid for all custom markup rendering, not only jupyter.

I think the right place for the caching layer is inside the custom renderer (which could be in its own docker container). To enable this, we need gitea to pass not only the file content and URLs but also the commit ID to the renderer.

@pavilo commented on GitHub (Nov 23, 2018): It would be relatively easy to add ipynb support through an external markup renderer (e.g. using ```jupyter nbconvert```) when #3025 is resolved. A vanilla version would call the command every time the notebook has to be rendered. Next (and very reasonable) step would be to cache the rendered file until the source file is changed (e.g. scoping the cache to the source file hash). I think the approach is valid for all custom markup rendering, not only jupyter. I think the right place for the caching layer is inside the custom renderer (which could be in its own docker container). To enable this, we need gitea to pass not only the file content and URLs but also the commit ID to the renderer.
GiteaMirror commented 2025-11-02 04:00:07 -06:00
Author
Owner
Copy Link

@westurner commented on GitHub (Mar 3, 2019):

"Rendering of jupyter notebook 'rich output' is still missing some capabilities"
https://gitlab.com/gitlab-org/gitlab-ce/issues/32784#note_97778959

...

@westurner commented on GitHub (Mar 3, 2019): "Rendering of jupyter notebook 'rich output' is still missing some capabilities" https://gitlab.com/gitlab-org/gitlab-ce/issues/32784#note_97778959 - https://gitlab.com/gitlab-org/notebooklab (VueJS) - https://github.com/kokes/nbviewer.js - ... - https://components.nteract.io/ (ReactJS) ... - [ ] Link/notebook button to https://nbviewer.jupyter.org for the current file
GiteaMirror commented 2025-11-02 04:00:08 -06:00
Author
Owner
Copy Link

@HarvsG commented on GitHub (Jul 21, 2020):

You may find https://github.com/go-gitea/gitea/pull/12261 and this draft tutorial helpful.

@HarvsG commented on GitHub (Jul 21, 2020): You may find https://github.com/go-gitea/gitea/pull/12261 and this draft [tutorial](https://gist.github.com/HarvsG/9463bbe06301e8fb58498ba1ec835893) helpful.
GiteaMirror commented 2025-11-02 04:00:08 -06:00
Author
Owner
Copy Link

@klamann commented on GitHub (Jul 22, 2020):

@HarvsG using nbconvert is not a satisfiable solution, due to all the reasons that were mentioned in the first post (security, performance, dependencies). A solution built around a JS library like nbviewer.js would be preferable.

@klamann commented on GitHub (Jul 22, 2020): @HarvsG using `nbconvert` is not a satisfiable solution, due to all the reasons that were mentioned in the first post (security, performance, dependencies). A solution built around a JS library like [nbviewer.js](https://github.com/kokes/nbviewer.js) would be preferable.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
$20
$250
$50
$500
backport/done
💎 Bounty
docs-update-needed
good first issue
hacktoberfest
issue/bounty
issue/confirmed
issue/critical
issue/duplicate
issue/needs-feedback
issue/not-a-bug
issue/regression
issue/stale
issue/workaround
lgtm/need 2
modifies/api
modifies/translation
outdated/backport/v1.18
outdated/theme/markdown
outdated/theme/timetracker
performance/bigrepo
performance/cpu
performance/memory
performance/speed
pr/breaking
proposal/accepted
proposal/rejected
pr/wip
pull-request
Mirrored from GitHub Pull Request
 reviewed/wontfix
💰 Rewarded
skip-changelog
status/blocked
topic/accessibility
topic/api
topic/authentication
topic/build
topic/code-linting
topic/commit-signing
topic/content-rendering
topic/deployment
topic/distribution
topic/federation
topic/gitea-actions
topic/issues
topic/lfs
topic/mobile
topic/moderation
topic/packages
topic/pr
topic/projects
topic/repo
topic/repo-migration
topic/security
topic/theme
topic/ui
topic/ui-interaction
topic/ux
topic/webhooks
topic/wiki
type/bug
type/deprecation
type/docs
type/enhancement
type/feature
type/miscellaneous
type/proposal
type/question
type/refactoring
type/summary
type/testing
type/upstream
No Label type/proposal
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/gitea#1414
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?