@marimo-team/islands 0.22.5-dev6 → 0.22.5-dev8

package/dist/{process-output-BvkX_OeE.js → process-output-C0tmJosY.js}

@@ -33,7 +33,7 @@ import { a as parser, i as pythonLanguage, n as localCompletionSource, r as pyth
 import { n as stexMath } from "./stex-D887Ylhf.js";
 import { t as purify } from "./purify.es-hTCfRGdl.js";
 import { t as useAsyncData } from "./useAsyncData-C9ez7Ilo.js";
-let createActions$1, elementContainsMarimoCellFile, MarimoIncomingMessageEvent, PaintRoller, moveToEndOfEditor, DotFilledIcon, CircleX, PluralWords, contextToXml, Content2$1, normalizeName, AccordionContent, Wrench, createVariableInfoElement, Accordion, Trigger2, MarkdownLanguageAdapter, BorderAllIcon, File, repl, base64ToDataView, dataSourceConnectionsAtom, PinRightIcon, Braces, getDataTypeColor, ChatBubbleIcon, FileText, adaptForLocalStorage, extractBase64FromDataURL, getRequestClient, base64ToUint8Array, getTableType, CheckIcon, Eye, jotaiJsonStorage, MarimoValueReadyEvent, LoaderCircle, DeferredRequestRegistry, MarimoValueUpdateEvent, Layers, generateUUID, AccordionItem, Trash2, PathBuilder, createInputEvent, Info, useChromeActions, cellErrorsAtom, singleFacet, ChevronDownIcon, Database, variablesAtom, Sections, Close$1, isInternalCellName, AIContextRegistry, Root2$2, customPythonLanguageSupport, deserializeBlob, esm_default, require_client, PinLeftIcon, CircleAlert, DATA_TYPE_ICON, base64ToDataURL, import_lib$1, allTablesAtom, safeExtractSetUIElementMessageBuffers, useRequestClient, isDataURLString, requestClientAtom, renderHTML, isUninstantiated, useExpandedConsoleOutput, jsonToTSV, headingToIdentifier, toPng$1, parseAttrValue, useCellActions, getDatasourceContext, selectAtom, displayCellName, useCellFocusActions, CellOutputId, createCell, Spinner, UIElementId, initialModeAtom, extractAllTracebackInfo, getCellEditorView, Popover, findCellId, kioskModeAtom, isOutputEmpty, jsonToMarkdown, isErrorMime, PopoverTrigger, jsonParseWithSpecialChar, outputIsStale, PythonIcon, filenameAtom, reducer$1, MarimoValueInputEvent, NotebookPen, goToCellLine, AccordionTrigger, Table2, Paths, useLastFocusedCellId, HTMLCellId, AnsiUp, PopoverContent, RANDOM_ID_ATTR, outputIsLoading, blobToString, NotebookScopedLocalStorage, notebookAtom, MarkdownRenderer, parseDataset, useCellIds, PopoverClose, OBJECT_ID_ATTR, viewStateAtom, dataViewToBase64, convertStatsName, filesToBase64, ZodLocalStorage, notebookOutline, LazyAnyLanguageCodeMirror, parseInitialValue, useCellNames, processOutput, getTracebackInfo, getCellNames, maybeAddAltairImport, SCRATCH_CELL_ID, getInitialAppMode, useExpandedOutput, atomWithReducer, DATA_CELL_ID, AIContextProvider, Item, Checkbox, Boosts, Anchor2, getValidName, DatasourceContextProvider, atomWithStorage, getCellDomProps, ChevronRightIcon, Columns2, PluralWord;
+let createActions$1, singleFacet, MarimoIncomingMessageEvent, Table2, Paths, DotFilledIcon, Columns2, PluralWord, contextToXml, Close$1, isInternalCellName, AccordionContent, Trigger2, MarkdownLanguageAdapter, Accordion, Root2$2, customPythonLanguageSupport, BorderAllIcon, Info, useChromeActions, base64ToDataView, import_lib$1, allTablesAtom, PinRightIcon, CircleAlert, DATA_TYPE_ICON, ChatBubbleIcon, File, repl, extractBase64FromDataURL, convertStatsName, base64ToUint8Array, dataSourceConnectionsAtom, CheckIcon, FileText, adaptForLocalStorage, MarimoValueReadyEvent, NotebookPen, goToCellLine, MarimoValueUpdateEvent, LoaderCircle, DeferredRequestRegistry, AccordionItem, Wrench, createVariableInfoElement, createInputEvent, Layers, generateUUID, cellErrorsAtom, isUninstantiated, ChevronDownIcon, Eye, jotaiJsonStorage, Sections, Anchor2, getValidName, AIContextRegistry, Item, Checkbox, deserializeBlob, Braces, getDataTypeColor, PinLeftIcon, CircleX, PluralWords, base64ToDataURL, esm_default, require_client, safeExtractSetUIElementMessageBuffers, requestClientAtom, isDataURLString, getRequestClient, renderHTML, useRequestClient, useExpandedConsoleOutput, jsonToMarkdown, headingToIdentifier, toPng$1, filenameAtom, useCellActions, getDatasourceContext, atomWithStorage, getCellDomProps, useCellFocusActions, parseInitialValue, createCell, Spinner, SCRATCH_CELL_ID, initialModeAtom, elementContainsMarimoCellFile, getCellEditorView, Popover, UIElementId, kioskModeAtom, isOutputEmpty, jsonParseWithSpecialChar, isErrorMime, PopoverTrigger, RANDOM_ID_ATTR, outputIsStale, PythonIcon, ZodLocalStorage, reducer$1, MarimoValueInputEvent, PaintRoller, moveToEndOfEditor, AccordionTrigger, Trash2, PathBuilder, useLastFocusedCellId, CellOutputId, AnsiUp, PopoverContent, OBJECT_ID_ATTR, outputIsLoading, blobToString, getTracebackInfo, notebookAtom, MarkdownRenderer, parseAttrValue, useCellIds, PopoverClose, findCellId, viewStateAtom, dataViewToBase64, getTableType, filesToBase64, NotebookScopedLocalStorage, notebookOutline, LazyAnyLanguageCodeMirror, parseDataset, useCellNames, processOutput, extractAllTracebackInfo, getCellNames, maybeAddAltairImport, HTMLCellId, getInitialAppMode, useExpandedOutput, jsonToTSV, sanitizeHtml, AIContextProvider, Content2$1, normalizeName, Boosts, selectAtom, displayCellName, DatasourceContextProvider, atomWithReducer, DATA_CELL_ID, ChevronRightIcon, Database, variablesAtom;
 let __tla = Promise.all([
   (() => {
     try {
@@ -24379,7 +24379,7 @@ ${n.sqlString}
       t.tagName === "A" && t.hasAttribute(e) && (t.setAttribute("target", t.getAttribute(e) || ""), t.removeAttribute(e), t.getAttribute("target") === "_blank" && t.setAttribute("rel", "noopener noreferrer"));
     });
   }
-  function sanitizeHtml(e) {
+  sanitizeHtml = function(e) {
     let t = {
       USE_PROFILES: {
         html: true,
@@ -24401,7 +24401,7 @@ ${n.sqlString}
       SAFE_FOR_XML: !e.includes("marimo-mermaid")
     };
     return purify.sanitize(e, t);
-  }
+  };
   var excludedTags = [
     "marimo-carousel",
     "marimo-tabs",
@@ -28370,156 +28370,157 @@ ${t}
 });
 export {
   createActions$1 as $,
-  elementContainsMarimoCellFile as $t,
+  singleFacet as $t,
   MarimoIncomingMessageEvent as A,
-  PaintRoller as An,
-  moveToEndOfEditor as At,
+  Table2 as An,
+  Paths as At,
   DotFilledIcon as B,
-  CircleX as Bn,
-  PluralWords as Bt,
+  Columns2 as Bn,
+  PluralWord as Bt,
   contextToXml as C,
-  Content2$1 as Cn,
-  normalizeName as Ct,
+  Close$1 as Cn,
+  isInternalCellName as Ct,
   AccordionContent as D,
-  Wrench as Dn,
-  createVariableInfoElement as Dt,
+  Trigger2 as Dn,
+  MarkdownLanguageAdapter as Dt,
   Accordion as E,
-  Trigger2 as En,
-  MarkdownLanguageAdapter as Et,
+  Root2$2 as En,
+  customPythonLanguageSupport as Et,
   BorderAllIcon as F,
-  File as Fn,
-  repl as Ft,
+  Info as Fn,
+  useChromeActions as Ft,
   base64ToDataView as G,
-  dataSourceConnectionsAtom as Gt,
+  import_lib$1 as Gn,
+  allTablesAtom as Gt,
   PinRightIcon as H,
-  Braces as Hn,
-  getDataTypeColor as Ht,
+  CircleAlert as Hn,
+  DATA_TYPE_ICON as Ht,
   ChatBubbleIcon as I,
-  FileText as In,
-  adaptForLocalStorage as It,
+  File as In,
+  repl as It,
   extractBase64FromDataURL as J,
-  getRequestClient as Jt,
+  convertStatsName as Jt,
   base64ToUint8Array as K,
-  getTableType as Kt,
+  dataSourceConnectionsAtom as Kt,
   CheckIcon as L,
-  Eye as Ln,
-  jotaiJsonStorage as Lt,
+  FileText as Ln,
+  adaptForLocalStorage as Lt,
   MarimoValueReadyEvent as M,
-  LoaderCircle as Mn,
-  DeferredRequestRegistry as Mt,
+  NotebookPen as Mn,
+  goToCellLine as Mt,
   MarimoValueUpdateEvent as N,
-  Layers as Nn,
-  generateUUID as Nt,
+  LoaderCircle as Nn,
+  DeferredRequestRegistry as Nt,
   AccordionItem as O,
-  Trash2 as On,
-  PathBuilder as Ot,
+  Wrench as On,
+  createVariableInfoElement as Ot,
   createInputEvent as P,
-  Info as Pn,
-  useChromeActions as Pt,
+  Layers as Pn,
+  generateUUID as Pt,
   cellErrorsAtom as Q,
-  singleFacet as Qt,
+  isUninstantiated as Qt,
   ChevronDownIcon as R,
-  Database as Rn,
-  variablesAtom as Rt,
+  Eye as Rn,
+  jotaiJsonStorage as Rt,
   Sections as S,
-  Close$1 as Sn,
-  isInternalCellName as St,
+  Anchor2 as Sn,
+  getValidName as St,
   AIContextRegistry as T,
-  Root2$2 as Tn,
-  customPythonLanguageSupport as Tt,
+  Item as Tn,
+  Checkbox as Tt,
   deserializeBlob as U,
-  esm_default as Un,
-  require_client as Ut,
+  Braces as Un,
+  getDataTypeColor as Ut,
   PinLeftIcon as V,
-  CircleAlert as Vn,
-  DATA_TYPE_ICON as Vt,
+  CircleX as Vn,
+  PluralWords as Vt,
   base64ToDataURL as W,
-  import_lib$1 as Wn,
-  allTablesAtom as Wt,
+  esm_default as Wn,
+  require_client as Wt,
   safeExtractSetUIElementMessageBuffers as X,
-  useRequestClient as Xt,
+  requestClientAtom as Xt,
   isDataURLString as Y,
-  requestClientAtom as Yt,
+  getRequestClient as Yt,
   renderHTML as Z,
-  isUninstantiated as Zt,
+  useRequestClient as Zt,
   useExpandedConsoleOutput as _,
   __tla,
-  jsonToTSV as _n,
+  jsonToMarkdown as _n,
   headingToIdentifier as _t,
   toPng$1 as a,
-  parseAttrValue as an,
+  filenameAtom as an,
   useCellActions as at,
   getDatasourceContext as b,
-  selectAtom as bn,
-  displayCellName as bt,
+  atomWithStorage as bn,
+  getCellDomProps as bt,
   useCellFocusActions as c,
-  CellOutputId as cn,
+  parseInitialValue as cn,
   createCell as ct,
   Spinner as d,
-  UIElementId as dn,
+  SCRATCH_CELL_ID as dn,
   initialModeAtom as dt,
-  extractAllTracebackInfo as en,
+  elementContainsMarimoCellFile as en,
   getCellEditorView as et,
   Popover as f,
-  findCellId as fn,
+  UIElementId as fn,
   kioskModeAtom as ft,
   isOutputEmpty as g,
-  jsonToMarkdown as gn,
+  jsonParseWithSpecialChar as gn,
   isErrorMime as gt,
   PopoverTrigger as h,
-  jsonParseWithSpecialChar as hn,
+  RANDOM_ID_ATTR as hn,
   outputIsStale as ht,
   PythonIcon as i,
-  filenameAtom as in,
+  ZodLocalStorage as in,
   reducer$1 as it,
   MarimoValueInputEvent as j,
-  NotebookPen as jn,
-  goToCellLine as jt,
+  PaintRoller as jn,
+  moveToEndOfEditor as jt,
   AccordionTrigger as k,
-  Table2 as kn,
-  Paths as kt,
+  Trash2 as kn,
+  PathBuilder as kt,
   useLastFocusedCellId as l,
-  HTMLCellId as ln,
+  CellOutputId as ln,
   AnsiUp as lt,
   PopoverContent as m,
-  RANDOM_ID_ATTR as mn,
+  OBJECT_ID_ATTR as mn,
   outputIsLoading as mt,
   blobToString as n,
-  NotebookScopedLocalStorage as nn,
+  getTracebackInfo as nn,
   notebookAtom as nt,
   MarkdownRenderer as o,
-  parseDataset as on,
+  parseAttrValue as on,
   useCellIds as ot,
   PopoverClose as p,
-  OBJECT_ID_ATTR as pn,
+  findCellId as pn,
   viewStateAtom as pt,
   dataViewToBase64 as q,
-  convertStatsName as qt,
+  getTableType as qt,
   filesToBase64 as r,
-  ZodLocalStorage as rn,
+  NotebookScopedLocalStorage as rn,
   notebookOutline as rt,
   LazyAnyLanguageCodeMirror as s,
-  parseInitialValue as sn,
+  parseDataset as sn,
   useCellNames as st,
   processOutput as t,
-  getTracebackInfo as tn,
+  extractAllTracebackInfo as tn,
   getCellNames as tt,
   maybeAddAltairImport as u,
-  SCRATCH_CELL_ID as un,
+  HTMLCellId as un,
   getInitialAppMode as ut,
   useExpandedOutput as v,
-  atomWithReducer as vn,
-  DATA_CELL_ID as vt,
+  jsonToTSV as vn,
+  sanitizeHtml as vt,
   AIContextProvider as w,
-  Item as wn,
-  Checkbox as wt,
+  Content2$1 as wn,
+  normalizeName as wt,
   Boosts as x,
-  Anchor2 as xn,
-  getValidName as xt,
+  selectAtom as xn,
+  displayCellName as xt,
   DatasourceContextProvider as y,
-  atomWithStorage as yn,
-  getCellDomProps as yt,
+  atomWithReducer as yn,
+  DATA_CELL_ID as yt,
   ChevronRightIcon as z,
-  Columns2 as zn,
-  PluralWord as zt
+  Database as zn,
+  variablesAtom as zt
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@marimo-team/islands",
-  "version": "0.22.5-dev6",
+  "version": "0.22.5-dev8",
   "main": "dist/main.js",
   "types": "dist/index.d.ts",
   "type": "module",

package/src/components/editor/errors/traceback-modal.tsx

@@ -12,6 +12,8 @@ import {
 } from "@/components/ui/alert-dialog";
 import { CopyIcon } from "lucide-react";
 import { toast } from "@/components/ui/use-toast";
+import { renderHTML } from "@/plugins/core/RenderHTML";
+import { sanitizeHtml } from "@/plugins/core/sanitize-html";
 
 interface TracebackModalProps {
   isOpen: boolean;
@@ -29,7 +31,7 @@ export const TracebackModal: React.FC<TracebackModalProps> = ({
   const handleCopy = async () => {
     // Strip HTML tags for clipboard
     const tempDiv = document.createElement("div");
-    tempDiv.innerHTML = traceback;
+    tempDiv.innerHTML = sanitizeHtml(traceback);
     const textContent = tempDiv.textContent || tempDiv.innerText || "";
 
     try {
@@ -73,10 +75,9 @@ export const TracebackModal: React.FC<TracebackModalProps> = ({
               Copy
             </Button>
           </div>
-          <div
-            className="font-code text-sm p-4 bg-muted rounded border overflow-auto max-h-[50vh] cursor-text select-text"
-            dangerouslySetInnerHTML={{ __html: traceback }}
-          />
+          <div className="font-code text-sm p-4 bg-muted rounded border overflow-auto max-h-[50vh] cursor-text select-text">
+            {renderHTML({ html: traceback })}
+          </div>
         </div>
         <AlertDialogFooter>
           <AlertDialogAction onClick={onClose}>Close</AlertDialogAction>

package/src/components/editor/output/MarimoErrorOutput.tsx

@@ -25,6 +25,7 @@ import { useChromeActions } from "../chrome/state";
 import { AutoFixButton } from "../errors/auto-fix";
 import { CellLinkError } from "../links/cell-link";
 import { processTextForUrls } from "./console/text-rendering";
+import { renderHTML } from "@/plugins/core/RenderHTML";
 
 const Tip = (props: {
   title?: string;
@@ -486,13 +487,9 @@ export const MarimoErrorOutput = ({
                       {processTextForUrls(error.msg, `exception-${idx}`)}
                     </p>
                     {"traceback" in error && error.traceback ? (
-                      <div
-                        className="font-code text-sm mt-2 p-3 bg-muted rounded border overflow-auto max-h-[50vh] cursor-text select-text"
-                        // biome-ignore lint/security/noDangerouslySetInnerHtml: traceback from backend
-                        dangerouslySetInnerHTML={{
-                          __html: error.traceback,
-                        }}
-                      />
+                      <div className="font-code text-sm mt-2 p-3 bg-muted rounded border overflow-auto max-h-[50vh] cursor-text select-text">
+                        {renderHTML({ html: error.traceback })}
+                      </div>
                     ) : (
                       <div className="text-muted-foreground mt-2">
                         See the console area for a traceback.
@@ -504,13 +501,9 @@ export const MarimoErrorOutput = ({
                     {processTextForUrls(error.msg, `exception-${idx}`)}
                     <CellLinkError cellId={error.raising_cell} />
                     {"traceback" in error && error.traceback && (
-                      <div
-                        className="font-code text-sm mt-2 p-3 bg-muted rounded border overflow-auto max-h-[50vh] cursor-text select-text"
-                        // biome-ignore lint/security/noDangerouslySetInnerHtml: traceback from backend
-                        dangerouslySetInnerHTML={{
-                          __html: error.traceback,
-                        }}
-                      />
+                      <div className="font-code text-sm mt-2 p-3 bg-muted rounded border overflow-auto max-h-[50vh] cursor-text select-text">
+                        {renderHTML({ html: error.traceback })}
+                      </div>
                     )}
                   </div>
                 )}

package/src/components/editor/output/MarimoTracebackOutput.tsx

@@ -34,6 +34,7 @@ import { getRequestClient } from "@/core/network/requests";
 import { isStaticNotebook } from "@/core/static/static-state";
 import { isWasm } from "@/core/wasm/utils";
 import { renderHTML } from "@/plugins/core/RenderHTML";
+import { sanitizeHtml } from "@/plugins/core/sanitize-html";
 import { copyToClipboard } from "@/utils/copy";
 import {
   elementContainsMarimoCellFile,
@@ -173,9 +174,9 @@ export const MarimoTracebackOutput = ({
               </DropdownMenuItem>
               <DropdownMenuItem
                 onClick={() => {
-                  // Strip HTML from the traceback
+                  // Strip HTML from the traceback (sanitize first to prevent XSS)
                   const div = document.createElement("div");
-                  div.innerHTML = traceback;
+                  div.innerHTML = sanitizeHtml(traceback);
                   const textContent = div.textContent || "";
                   copyToClipboard(textContent);
                 }}
@@ -193,7 +194,7 @@ export const MarimoTracebackOutput = ({
 
 function lastLine(text: string): string {
   const el = document.createElement("div");
-  el.innerHTML = text;
+  el.innerHTML = sanitizeHtml(text);
   const lines = el.textContent?.split("\n").filter(Boolean);
   return lines?.at(-1) || "";
 }