upstream/ipython Files · IPython/html/tests/notebook/inject_js.js

don't store signatures in notebooks...

don't store signatures in notebooks store them in an sqlite database instead. The algorithm and signature are stored and not associated with a path. This means that moving files around doesn't affect trust, and every trusted change to a notebook remains trusted.

MinRK - - Load All Authors

File last commit:

r18587:1e136a8b


                r19625:0dbcfac8

Download file

             inject_js.js
        
                    23 lines
            
             | 650 B
            
                | application/javascript
            
             |
                JavascriptLexer
            
             / IPython / html / tests / notebook / inject_js.js
          
                    History
                
                 |
                  Annotation
                 | Raw
                 |Copy content
                 |Copy permalink

      //

      // Test robustness about JS injection in different place

      //

      // This assume malicious document arrive to the frontend.

      //

      casper.notebook_test(function () {

          var messages = [];

          this.on('remote.alert', function (msg) {

              messages.push(msg);

          });

          this.evaluate(function () {

              var cell = IPython.notebook.get_cell(0);

              var json = cell.toJSON();

              json.execution_count = "<script> alert('hello from input prompts !')</script>";

              cell.fromJSON(json);

          });

          this.then(function () {

              this.test.assert(messages.length == 0, "Captured log message from script tag injection !");

          });

      });

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages

				//
				// Test robustness about JS injection in different place
				//
				// This assume malicious document arrive to the frontend.
				//

				casper.notebook_test(function () {
				var messages = [];
				this.on('remote.alert', function (msg) {
				messages.push(msg);
				});

				this.evaluate(function () {
				var cell = IPython.notebook.get_cell(0);
				var json = cell.toJSON();
				json.execution_count = "<script> alert('hello from input prompts !')</script>";
				cell.fromJSON(json);
				});

				this.then(function () {
				this.test.assert(messages.length == 0, "Captured log message from script tag injection !");
				});
				});