databricks-tellr-app 0.4.3.dev3464__tar.gz → 0.5.1.dev1__tar.gz

{databricks_tellr_app-0.4.3.dev3464 → databricks_tellr_app-0.5.1.dev1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-tellr-app
-Version: 0.4.3.dev3464
+Version: 0.5.1.dev1
 Summary: Tellr application package for Databricks Apps
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown

{databricks_tellr_app-0.4.3.dev3464 → databricks_tellr_app-0.5.1.dev1}/databricks_tellr_app.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-tellr-app
-Version: 0.4.3.dev3464
+Version: 0.5.1.dev1
 Summary: Tellr application package for Databricks Apps
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown

{databricks_tellr_app-0.4.3.dev3464 → databricks_tellr_app-0.5.1.dev1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "databricks-tellr-app"
-version = "0.4.3.dev3464"
+version = "0.5.1.dev1"
 description = "Tellr application package for Databricks Apps"
 readme = "README.md"
 requires-python = ">=3.10"

{databricks_tellr_app-0.4.3.dev3464 → databricks_tellr_app-0.5.1.dev1}/src/services/converter_jail/jail.py

@@ -60,15 +60,17 @@ class ResourceLimits:
     nproc: Optional[int] = None  # None -> leave current soft limit
 
 
-def build_scrubbed_env() -> dict:
+def build_scrubbed_env(home: Optional[str] = None) -> dict:
     """Build the child environment: only PATH/LANG survive; HOME/TMPDIR point
-    at a fresh temp dir. No DATABRICKS_*, no Fernet key, no Lakebase creds."""
+    at ``home``, or a fresh temp dir the caller must remove when ``home`` is
+    None. No DATABRICKS_*, no Fernet key, no Lakebase creds."""
     env: dict = {}
     for key in _ENV_WHITELIST:
         if key in os.environ:
             env[key] = os.environ[key]
     env.setdefault("LANG", "C.UTF-8")
-    home = tempfile.mkdtemp(prefix="jail_home_")
+    if home is None:
+        home = tempfile.mkdtemp(prefix="jail_home_")
     env["HOME"] = home
     env["TMPDIR"] = home
     env["PYTHONHASHSEED"] = "0"

{databricks_tellr_app-0.4.3.dev3464 → databricks_tellr_app-0.5.1.dev1}/src/services/pptx_from_html_huashu.py

@@ -46,17 +46,45 @@ SIDECAR_SCRIPT = SIDECAR_DIR / "emit_deck.mjs"
 SIDECAR_SYS_LIBS_DIR = SIDECAR_DIR / "sys-libs"
 SIDECAR_TIMEOUT_SECONDS = 180  # huashu opens chromium per-slide; slower than pptx-emit
 
+# SDR-4437 F-CR-35: the only environment keys the node/Chromium child gets.
+# No DATABRICKS_*, no Fernet key, no Lakebase creds. HOME stays real (unlike
+# the converter jail's scrubbed env): Playwright finds Chromium under
+# ~/.cache/ms-playwright. Proxy and CA settings stay so the page can still
+# load Chart.js from its CDN.
+_SIDECAR_ENV_ALLOWLIST = (
+    "PATH",
+    "HOME",
+    "LANG",
+    "LC_ALL",
+    "LC_CTYPE",
+    "TMPDIR",
+    "LD_LIBRARY_PATH",
+    "PLAYWRIGHT_BROWSERS_PATH",
+    "XDG_CACHE_HOME",
+    "HTTP_PROXY",
+    "HTTPS_PROXY",
+    "NO_PROXY",
+    "http_proxy",
+    "https_proxy",
+    "no_proxy",
+    "SSL_CERT_FILE",
+    "SSL_CERT_DIR",
+    "NODE_EXTRA_CA_CERTS",
+)
+
 
 def sidecar_subprocess_env() -> dict[str, str]:
     """Build the env dict for any node subprocess that ends up spawning
-    Chromium. Prepends ``services/pptx-emit-huashu/sys-libs/`` onto
+    Chromium: an allowlist of the app's environment (see
+    ``_SIDECAR_ENV_ALLOWLIST``), never a copy of it. Prepends
+    ``services/pptx-emit-huashu/sys-libs/`` onto
     ``LD_LIBRARY_PATH`` if the directory exists, so Chromium can find the
     bundled libnspr4/libnss3/etc. on Databricks Apps where the host glibc-
     next runtime libs aren't installed. Scoping it here (not as a global
     env in app.yaml) prevents the Python process from accidentally loading
     incompatible libs from the bundle.
     """
-    env = os.environ.copy()
+    env = {k: os.environ[k] for k in _SIDECAR_ENV_ALLOWLIST if k in os.environ}
     if SIDECAR_SYS_LIBS_DIR.exists():
         existing = env.get("LD_LIBRARY_PATH", "")
         env["LD_LIBRARY_PATH"] = (

{databricks_tellr_app-0.4.3.dev3464 → databricks_tellr_app-0.5.1.dev1}/src/services/pptx_from_records.py

@@ -26,6 +26,8 @@ import tempfile
 from pathlib import Path
 from typing import Any
 
+from src.services.converter_jail.jail import build_scrubbed_env
+
 logger = logging.getLogger(__name__)
 
 def _resolve_sidecar_dir() -> Path:
@@ -81,6 +83,46 @@ def _sidecar_entrypoint() -> Path:
     return SIDECAR_BUNDLE if SIDECAR_BUNDLE.exists() else SIDECAR_SCRIPT
 
 
+def _drop_non_data_images(slides: list[Any]) -> list[Any]:
+    """Remove every image record whose ``src`` is not a ``data:`` URI.
+
+    SDR-4437 F-CR-35: pptxgenjs resolves any other ``src`` as a filesystem
+    path (``fs.readFileSync``) or an https URL and embeds the bytes in the
+    deck, so a client-supplied ``/proc/self/environ`` came back inside the
+    .pptx. The records are client-controlled, so this is the authoritative
+    gate; ``emit.mjs`` repeats it. Nothing legitimate is lost: the walker
+    emits ``data:`` URIs only, and the slide CSP (``img-src data:``) already
+    blocks any other ``<img>`` source in the preview.
+
+    The check mirrors ``emit.mjs`` exactly (``r.kind === 'image'``,
+    ``typeof src === 'string' && src.startsWith('data:')``), and the sidecar
+    receives this filtered structure re-serialized, so what passes here is
+    what the sidecar sees.
+    """
+    dropped = 0
+    cleaned: list[Any] = []
+    for slide in slides:
+        records = slide.get("records") if isinstance(slide, dict) else None
+        if isinstance(records, list):
+            kept = []
+            for record in records:
+                if isinstance(record, dict) and record.get("kind") == "image":
+                    src = record.get("src")
+                    if not (isinstance(src, str) and src.startswith("data:")):
+                        dropped += 1
+                        continue
+                kept.append(record)
+            slide = {**slide, "records": kept}
+        cleaned.append(slide)
+    if dropped:
+        logger.warning(
+            "Dropped %d image record(s) with a non-data: src before the "
+            "pptx-emit sidecar (SDR-4437 F-CR-35)",
+            dropped,
+        )
+    return cleaned
+
+
 def build_pptx(
     title: str,
     slides: list[dict[str, Any]],
@@ -108,7 +150,7 @@ def build_pptx(
     if font_mode not in ("universal", "custom", "google_slides"):
         font_mode = "universal"
 
-    payload = {"title": title, "font_mode": font_mode, "slides": slides}
+    payload = {"title": title, "font_mode": font_mode, "slides": _drop_non_data_images(slides)}
     payload_bytes = json.dumps(payload).encode("utf-8")
 
     with tempfile.TemporaryDirectory() as td:
@@ -119,12 +161,16 @@ def build_pptx(
             " ".join(cmd), len(payload_bytes), len(slides),
         )
         try:
+            # SDR-4437 F-CR-35: the sidecar holds no credentials of its own.
+            # Defence in depth only — it runs as the app's OS user, so the
+            # image-src filter above is what removes the file-read primitive.
             result = subprocess.run(
                 cmd,
                 input=payload_bytes,
                 capture_output=True,
                 timeout=SIDECAR_TIMEOUT_SECONDS,
                 check=False,
+                env=build_scrubbed_env(home=td),
             )
         except subprocess.TimeoutExpired as e:
             raise EmitError(f"Sidecar timed out after {SIDECAR_TIMEOUT_SECONDS}s") from e