Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add a toggle to skip the svg encoding of images #2106

Merged
merged 4 commits into from
Feb 7, 2024

Conversation

gwincr11
Copy link
Contributor

@gwincr11 gwincr11 commented Feb 7, 2024

The svg being encoded to base64 introduced in #2018 is not a secure option for GitHub's use case. This pr adds an option to bypass this encoding so we can continue to use the standard svg output.

@blink1073 blink1073 changed the title add a toggle to skip the svg encoding of images Add a toggle to skip the svg encoding of images Feb 7, 2024
Copy link
Contributor

@blink1073 blink1073 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you!

@blink1073 blink1073 merged commit 87db94d into jupyter:main Feb 7, 2024
24 of 25 checks passed
@gwincr11
Copy link
Contributor Author

gwincr11 commented Feb 7, 2024

Thanks!

@jstorrs
Copy link
Contributor

jstorrs commented Feb 13, 2024

Can you provide some information about how base64 encoded XML is "not a secure option"?

Everything I've read is the opposite--bare SVG directly encorporated into the DOM is a major security problem unless that SVG is known to be trusted since the SVG becomes indistinguishable from the DOM and has full access to the page. Specifically: see GHSL-2021-1018 which discloses this injection vulnerability in nbconvert.
Malicious SVG can include javascript, premature closing tags, etc. Base64 encoding the svg specifically triggers isolation in browsers that prevent this sort of mischief. That isolation does not exist when incorporated directly into the page as this flag enables.

I have no issue with the flag being made available, but I find the discussion to be very misleading. This flag enables vulnerabilities and does not increase security at all. It should be clearly marked as enabling unsafe behavior IMHO.

@gwincr11
Copy link
Contributor Author

I am not on the security teams so I am not the expert here. What I can say is that in reviewing attack vectors in python notebooks when building the notebook rendering service, base64 encoded data and image attributes were called out as a particular concern, so we strip all base64 encoded data regardles of where it is on the page. https://subfn.net/2020/04/14/base64-tricks/

We can more easily detect svg images and clear out what we don't want, the obfuscation of base64 makes it impossible to know what is in the payload.

This pull request was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants