Skip to content

[BUG] Relax itables version to >= 2.4.0 #780

Description

Describe the bug

graph-notebook==5.2.0 pins itables>=2.0.0,<=2.1.0 in pyproject.toml. This upper bound predates itables 2.4.0, in which HTML content in DataFrame cells is escaped by default (fix: mwouts/itables#346). In itables<=2.1.0, cell contents are passed verbatim to DataTables and rendered as live HTML/JS.

graph-notebook itself is not affected afaik, but it would be nice to relax itables version to avoid installing a vulnerable dependency

Environment

  • OS: Ubuntu 24.04
  • Browser: Google Chrome
  • graph-notebook: 5.2.0

To Reproduce
In a fresh JupyterLab environment with graph-notebook==5.2.0 installed (which pulls itables==2.1.0), run:

import pandas as pd
from itables import show
results_df = pd.DataFrame({
    "id":   [1, 2, 3],
    "name": [
        "alice",
        "bob",
        '</script>\\"<script>alert(\'random text\')</script>',
    ],
})
show(results_df)
Image

Expected behavior

No live html rendered

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions