solara-ui 1.34.1__tar.gz → 1.35.1__tar.gz

{solara_ui-1.34.1 → solara_ui-1.35.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: solara-ui
-Version: 1.34.1
+Version: 1.35.1
 Dynamic: Summary
 Project-URL: Home, https://www.github.com/widgetti/solara
 Project-URL: Documentation, https://solara.dev

{solara_ui-1.34.1 → solara_ui-1.35.1}/solara/__init__.py

@@ -1,6 +1,6 @@
 """Build webapps using IPywidgets"""
 
-__version__ = "1.34.1"
+__version__ = "1.35.1"
 github_url = "https://github.com/widgetti/solara"
 git_branch = "master"
 

{solara_ui-1.34.1 → solara_ui-1.35.1}/solara/__main__.py

@@ -653,7 +653,7 @@ def markdown(target: typing.Optional[Path] = None):
 
 
 def write_script(name: str, target: typing.Optional[Path]):
-    code = (HERE / "template" / f"{name}.py").read_text()
+    code = (HERE / "template" / f"{name}.py").read_text(encoding="utf-8")
     if target is None:
         target = Path("sol.py")
     else:

{solara_ui-1.34.1 → solara_ui-1.35.1}/solara/autorouting.py

@@ -215,11 +215,9 @@ def RenderPage(main_name: str = "Page"):
                         solara.Button(
                             icon_name="mdi-pencil", icon=True, href=url, target="_blank", style={"position": "absolute", "top": "0px", "right": "0px"}
                         )
-                    # solara.Markdown(path.read_text(), unsafe_solara_execute=True)
-                    component(path.read_text(), unsafe_solara_execute=True)
+                    component(path.read_text(encoding="utf-8"), unsafe_solara_execute=True)
             else:
-                # content = solara.Markdown(path.read_text(), unsafe_solara_execute=True)
-                content = component(path.read_text(), unsafe_solara_execute=True)
+                content = component(path.read_text(encoding="utf-8"), unsafe_solara_execute=True)
 
             main = solara.Div(
                 classes=["solara-autorouter-content"],

{solara_ui-1.34.1 → solara_ui-1.35.1}/solara/components/applayout.py

@@ -342,7 +342,7 @@ def AppLayout(
                     ):
                         if not show_app_bar:
                             AppIcon(sidebar_open, on_click=lambda: set_sidebar_open(not sidebar_open))
-                        v.Html(tag="div", children=children_sidebar, style_="padding: 12px;").meta(ref="sidebar-content")
+                        v.Html(tag="div", children=children_sidebar, style_="padding: 12px; height: 100%").meta(ref="sidebar-content")
             if show_app_bar:
                 # if hide_on_scroll is True, and we have a little bit of scrolling, vuetify seems to act strangely
                 # when scrolling (on @mariobuikhuizen/vuetify v2.2.26-rc.0

{solara_ui-1.34.1 → solara_ui-1.35.1}/solara/components/file_browser.py

@@ -51,12 +51,12 @@ class FileListWidget(vy.VuetifyTemplate):
 @solara.component
 def FileBrowser(
     directory: Union[None, str, Path, solara.Reactive[Path]] = None,
-    on_directory_change: Callable[[Path], None] = None,
-    on_path_select: Callable[[Optional[Path]], None] = None,
-    on_file_open: Callable[[Path], None] = None,
+    on_directory_change: Optional[Callable[[Path], None]] = None,
+    on_path_select: Optional[Callable[[Optional[Path]], None]] = None,
+    on_file_open: Optional[Callable[[Path], None]] = None,
     filter: Callable[[Path], bool] = lambda x: True,
     directory_first: bool = False,
-    on_file_name: Callable[[str], None] = None,
+    on_file_name: Optional[Callable[[str], None]] = None,
     start_directory=None,
     can_select=False,
 ):
@@ -98,11 +98,11 @@ def FileBrowser(
     scroll_pos, set_scroll_pos = solara.use_state(0)
     selected, set_selected = solara.use_state(None)
 
-    def change_dir(new_dir: str):
+    def change_dir(new_dir: Path):
         if os.access(new_dir, os.R_OK):
-            current_dir.value = Path(new_dir)
+            current_dir.value = new_dir
             if on_directory_change:
-                on_directory_change(Path(new_dir))
+                on_directory_change(new_dir)
             set_warning(None)
             return True
         else:
@@ -114,8 +114,7 @@ def FileBrowser(
                 on_path_select(None)
             return
         if item["name"] == "..":
-            current_dir_str = str(current_dir.value)
-            new_dir = current_dir_str[: current_dir_str.rfind(os.path.sep)]
+            new_dir = current_dir.value.parent
             action_change_directory = (can_select and double_click) or (not can_select and not double_click)
             if action_change_directory and change_dir(new_dir):
                 if scroll_pos_stack:
@@ -128,17 +127,17 @@ def FileBrowser(
                     on_path_select(None)
             if can_select and not double_click:
                 if on_path_select:
-                    on_path_select(Path(new_dir))
+                    on_path_select(new_dir)
             return
 
-        path = os.path.join(current_dir.value, item["name"])
+        path = current_dir.value / item["name"]
         is_file = item["is_file"]
         if (can_select and double_click) or (not can_select and not double_click):
             if is_file:
                 if on_file_open:
-                    on_file_open(Path(path))
+                    on_file_open(path)
                 if on_file_name is not None:
-                    on_file_name(path)
+                    on_file_name(str(path))
             else:
                 if change_dir(path):
                     set_scroll_pos_stack(scroll_pos_stack + [scroll_pos])
@@ -149,7 +148,7 @@ def FileBrowser(
                 on_path_select(None)
         elif can_select and not double_click:
             if on_path_select:
-                on_path_select(Path(path))
+                on_path_select(path)
         else:  # not can_select and double_click is ignored
             raise RuntimeError("Combination should not happen")  # pragma: no cover
 

{solara_ui-1.34.1 → solara_ui-1.35.1}/solara/components/markdown.py

@@ -185,10 +185,7 @@ module.exports = {
                 document.head.appendChild(script);
             });
         },
-        getBaseUrl() {
-            if (window.solara && window.solara.rootPath !== undefined) {
-                return solara.rootPath + "/";
-            }
+        getJupyterBaseUrl() {
             // if base url is set, we use ./ for relative paths compared to the base url
             if (document.getElementsByTagName("base").length) {
                 return "./";
@@ -205,7 +202,7 @@ module.exports = {
             return base
         },
         getCdn() {
-            return this.cdn || (typeof solara_cdn !== "undefined" && solara_cdn) || `${this.getBaseUrl()}_solara/cdn`;
+            return this.cdn || (window.solara ? window.solara.cdn : `${this.getJupyterBaseUrl()}_solara/cdn`);
         }
     },
     updated() {

{solara_ui-1.34.1 → solara_ui-1.35.1}/solara/components/style.py

@@ -52,7 +52,7 @@ def Style(value: Union[str, Path] = ""):
                 try:
                     async for _ in watchfiles.awatch(value):
                         print(value, "changed, reloading css")  # noqa
-                        set_css_content_reloaded(cast(Path, value).read_text())
+                        set_css_content_reloaded(cast(Path, value).read_text(encoding="utf-8"))
                 except RuntimeError:
                     pass  # swallow the RuntimeError: Already borrowed errors from watchfiles
                 except Exception:
@@ -70,7 +70,7 @@ def Style(value: Union[str, Path] = ""):
     if css_content_reloaded is not None:
         css_content = css_content_reloaded
     else:
-        css_content = value.read_text() if isinstance(value, Path) else value
+        css_content = value.read_text(encoding="utf-8") if isinstance(value, Path) else value
     # del value
     hash = hashlib.sha256(css_content.encode("utf-8")).hexdigest()
     # the key is unique for this component + value

{solara_ui-1.34.1 → solara_ui-1.35.1}/solara/server/app.py

@@ -229,7 +229,7 @@ class AppScript:
         path = Path(name)
         if path.suffix == ".vue":
             logger.info("Vue file changed: %s", name)
-            template_content = path.read_text()
+            template_content = path.read_text(encoding="utf-8")
             for context in list(kernel_context.contexts.values()):
                 with context:
                     for filepath, widget in context.templates.items():

{solara_ui-1.34.1 → solara_ui-1.35.1}/solara/server/cdn_helper.py

@@ -3,6 +3,7 @@ import pathlib
 import shutil
 
 import requests
+from solara.server.utils import path_is_child_of
 
 import solara.settings
 
@@ -13,6 +14,9 @@ cdn_url_path = "_solara/cdn"
 
 def put_in_cache(base_cache_dir: pathlib.Path, path, data: bytes):
     cache_path = base_cache_dir / path
+    if not path_is_child_of(cache_path, base_cache_dir):
+        raise PermissionError("Trying to write outside of cache directory")
+
     pathlib.Path(cache_path.parent).mkdir(parents=True, exist_ok=True)
     try:
         logger.info("Writing cache file: %s", cache_path)
@@ -22,7 +26,14 @@ def put_in_cache(base_cache_dir: pathlib.Path, path, data: bytes):
 
 
 def get_from_cache(base_cache_dir: pathlib.Path, path):
-    cache_path = base_cache_dir / path
+    cache_path = pathlib.Path(base_cache_dir / path)
+    # Make sure cache_path is a subdirectory of base_cache_dir
+    # so we don't accidentally read files from the parent directory
+    # which is a security risk.
+    if not path_is_child_of(cache_path, base_cache_dir):
+        logger.warning("Trying to read from outside of cache directory: %s is not a subdir of %s", cache_path, base_cache_dir)
+        raise PermissionError("Trying to read from outside of cache directory")
+
     try:
         logger.info("Opening cache file: %s", cache_path)
         return cache_path.read_bytes()
@@ -58,6 +69,9 @@ def get_path(base_cache_dir: pathlib.Path, path) -> pathlib.Path:
     store_path = path if len(parts) != 1 else pathlib.Path(path) / "__main.js"
     cache_path = base_cache_dir / store_path
 
+    if not path_is_child_of(cache_path, base_cache_dir):
+        raise PermissionError("Trying to read from outside of cache directory")
+
     if cache_path.exists():
         # before d7eba856f100d5c3c64f4eec22c62390f084cb40 on windows, we could
         # accidentally write to the cache directory, so we need to check if we still

{solara_ui-1.34.1 → solara_ui-1.35.1}/solara/server/esm.py

@@ -40,7 +40,7 @@ def get_module_names():
 def create_modules():
     kernel_id = kernel_context.get_current_context().id
     _modules_added = _modules_added_per_kernel[kernel_id]
-    logger.info("define modules %s", _modules)
+    logger.info("create modules %s", _modules)
     widgets = {}
     with lock:
         for name, (module, dependencies) in _modules.items():

{solara_ui-1.34.1 → solara_ui-1.35.1}/solara/server/flask.py

@@ -199,7 +199,7 @@ def nbext(dir, filename):
     for directory in server.nbextensions_directories:
         file = directory / dir / filename
         if file.exists():
-            return send_from_directory(directory / dir, filename)
+            return send_from_directory(directory, dir + os.path.sep + filename)
     return flask.Response("not found", status=404)
 
 
@@ -217,7 +217,10 @@ if solara.settings.assets.proxy:
         if not allowed():
             abort(401)
         cache_directory = settings.assets.proxy_cache_dir
-        content = cdn_helper.get_data(Path(cache_directory), path)
+        try:
+            content = cdn_helper.get_data(Path(cache_directory), path)
+        except PermissionError:
+            return flask.Response("not found", status=404)
         mime = mimetypes.guess_type(path)
         return flask.Response(content, mimetype=mime[0])
 

{solara_ui-1.34.1 → solara_ui-1.35.1}/solara/server/starlette.py

@@ -3,6 +3,7 @@ import json
 import logging
 import math
 import os
+from pathlib import Path
 import sys
 import threading
 import typing
@@ -14,6 +15,8 @@ import starlette.websockets
 import uvicorn.server
 import websockets.legacy.http
 
+from solara.server.utils import path_is_child_of
+
 try:
     import solara_enterprise
 
@@ -405,6 +408,9 @@ class StaticNbFiles(StaticFilesOptionalAuth):
             original_path = os.path.join(directory, path)
             full_path = os.path.realpath(original_path)
             directory = os.path.realpath(directory)
+            # return early if someone tries to access a file outside of the directory
+            if not path_is_child_of(Path(original_path), Path(directory)):
+                return "", None
             try:
                 return full_path, os.stat(full_path)
             except (FileNotFoundError, NotADirectoryError):
@@ -449,7 +455,6 @@ class StaticCdn(StaticFilesOptionalAuth):
             full_path = str(get_path(settings.assets.proxy_cache_dir, path))
         except Exception:
             return "", None
-
         return full_path, os.stat(full_path)
 
 

{solara_ui-1.34.1 → solara_ui-1.35.1}/solara/server/static/solara_bootstrap.py

@@ -119,7 +119,7 @@ async def main():
     ]
     for dep in requirements:
         await micropip.install(dep, keep_going=True)
-    await micropip.install("/wheels/solara-1.34.1-py2.py3-none-any.whl", keep_going=True)
+    await micropip.install("/wheels/solara-1.35.1-py2.py3-none-any.whl", keep_going=True)
     import solara
 
     el = solara.Warning("lala")

{solara_ui-1.34.1 → solara_ui-1.35.1}/solara/server/threaded.py

@@ -2,15 +2,24 @@ import logging
 import threading
 import time
 from typing import Optional
+import socket
 
 logger = logging.getLogger("solara.server.threaded")
 
 
+def get_free_port():
+    sock = socket.socket()
+    sock.bind(("", 0))
+    port = sock.getsockname()[1]
+    sock.close()
+    return port
+
+
 class ServerBase(threading.Thread):
     name = "not set"
 
     def __init__(self, port: int, host: str = "localhost", **kwargs):
-        self.port = port
+        self.port = get_free_port() if port == 0 else port
         self.host = host
         self.base_url = f"http://{self.host}:{self.port}"
 

{solara_ui-1.34.1 → solara_ui-1.35.1}/solara/server/utils.py

@@ -1,6 +1,7 @@
 import contextlib
 import logging
 import os
+from pathlib import Path
 import pdb
 import traceback
 
@@ -16,6 +17,12 @@ def start_error(title, msg, exception: Exception = None):
     os._exit(-1)
 
 
+def path_is_child_of(path: Path, parent: Path) -> bool:
+    # We use os.path.normpath() because we do not want to follow symlinks
+    # in editable installs, since some packages are symlinked
+    return os.path.normpath(path).startswith(os.path.normpath(parent))
+
+
 @contextlib.contextmanager
 def pdb_guard():
     from . import settings

{solara_ui-1.34.1 → solara_ui-1.35.1}/solara/test/pytest_plugin.py

@@ -37,6 +37,7 @@ logger = logging.getLogger("solara.pytest_plugin")
 TEST_PORT_START = int(os.environ.get("PORT", "18765")) + 100  # do not interfere with the solara integration tests
 TEST_HOST = solara.server.settings.main.host
 TIMEOUT = float(os.environ.get("SOLARA_PW_TIMEOUT", "18"))
+PYTEST_IPYWIDGETS_SOLARA_APP_WAIT_TIMEOUT = int(os.environ.get("PYTEST_IPYWIDGETS_SOLARA_APP_WAIT_TIMEOUT", "10"))
 
 
 @pytest.fixture(scope="session")
@@ -192,7 +193,7 @@ def _solara_test(solara_server, solara_app, page_session: "playwright.sync_api.P
         run_events[id] = run_event = threading.Event()
         page_session.goto(solara_server.base_url + f"?id={id}")
         try:
-            assert run_event.wait(10)
+            assert run_event.wait(PYTEST_IPYWIDGETS_SOLARA_APP_WAIT_TIMEOUT)
             context = used_contexts[id]
             with context:
                 test_output_warmup = widgets.Output()

{solara_ui-1.34.1 → solara_ui-1.35.1}/solara/website/pages/changelog/changelog.md

@@ -1,5 +1,11 @@
 # Solara Changelog
 
+## Version 1.34.1
+
+   * Bug Fix: Using `SOLARA_ASSETS_PROXY=False` (default on [py.cafe](https://py.cafe)) would break grid layout. [#705](https://github.com/widgetti/solara/pull/705)
+   * Bug Fix: Hot reload work in more situations on Linux. [#702](https://github.com/widgetti/solara/pull/702)
+
+
 ## Version 1.34.0
 
    * Feature: Enhancements for Solara `InputDate` and `InputDateRange` components [#672](https://github.com/widgetti/solara/pull/672):

{solara_ui-1.34.1 → solara_ui-1.35.1}/solara/website/pages/documentation/advanced/content/10-howto/30-testing.md

@@ -411,3 +411,7 @@ To configure the ports the socket is bound to when starting the test servers, us
 #### Vuetify warmup
 
 By default, we insert an ipyvuetify widget with an icon into the frontend to force loading all the vuetify assets, such as CSS and fonts. However, if you are using the solara test plugin to test pure ipywidgets or a 3rd ipywidget based party library you might not need this. Disable this vuetify warmup phase by passing the `--no-solara-vuetify-warmup` argument to pytest, or setting the environment variable `SOLARA_TEST_VUETIFY_WARMUP` to a falsey value (e.g. `SOLARA_TEST_VUETIFY_WARMUP=0`).
+
+#### Changing the application wait timeout
+
+By default, we wait for 10 seconds for the browser to connect to the server when the solara server is used for testing. On slower systems, this may be too short. To change this timeout, set the `PYTEST_IPYWIDGETS_SOLARA_APP_WAIT_TIMEOUT` environment variable to the desired value in seconds (e.g. `PYTEST_IPYWIDGETS_SOLARA_APP_WAIT_TIMEOUT=20`).

solara_ui-1.35.1/tests/integration/apps/not-allowed

@@ -0,0 +1 @@
+not accessible

solara_ui-1.35.1/tests/integration/apps/public/test.txt

@@ -0,0 +1 @@
+test

solara_ui-1.35.1/tests/integration/apps/secure/app.py

@@ -0,0 +1,4 @@
+import solara
+
+
+page = solara.Button("Click me")

{solara_ui-1.34.1 → solara_ui-1.35.1}/tests/integration/server_test.py

@@ -5,8 +5,11 @@ import playwright
 import playwright.sync_api
 import pytest
 import reacton.ipywidgets as w
+import requests
 
 import solara
+import solara.server.server
+from solara.server import settings
 
 HERE = Path(__file__).parent
 
@@ -211,3 +214,100 @@ def test_kernel_asyncio(browser: playwright.sync_api.Browser, solara_server, sol
         context1.close()
         context2.close()
         solara.server.settings.kernel.threaded = threaded
+
+
+def test_cdn_secure(solara_server, solara_app, extra_include_path):
+    cdn_url = solara_server.base_url + "/_solara/cdn"
+    assert solara.settings.assets.proxy
+
+    with extra_include_path(HERE), solara_app("server_test:ClickButton"):
+        url = cdn_url + "/vue-grid-layout@1.0.2/dist/vue-grid-layout.min.js"
+        response = requests.get(url)
+        assert response.status_code == 200
+        # create a file in /share/solara
+        test_file = settings.assets.proxy_cache_dir.parent / "not-allowed"
+        test_file.write_text("test")
+        url = cdn_url + "/..%2fnot-allowed"
+        response = requests.get(url)
+        assert response.status_code == 404
+
+
+def test_nbextension_secure(solara_server, solara_app, extra_include_path):
+    nbextensions_url = solara_server.base_url + "/static/nbextensions"
+    nbextensions_directories = [k for k in solara.server.server.nbextensions_directories if k.exists()]
+    assert nbextensions_directories, "we should at least test one directory"
+    nbextensions_directory = nbextensions_directories[0]
+
+    with extra_include_path(HERE), solara_app("server_test:ClickButton"):
+        url = nbextensions_url + "/jupyter-vuetify/nodeps.js"
+        response = requests.get(url)
+        assert response.status_code == 200
+        test_file = nbextensions_directory.parent / "not-allowed"
+        test_file.write_text("test")
+        url = nbextensions_url + "/..%2fnot-allowed"
+        response = requests.get(url)
+        assert response.status_code == 404
+
+        url = nbextensions_url + "/foo/..%2f..%2fnot-allowed"
+        response = requests.get(url)
+        assert response.status_code == 404
+
+
+def test_assets_secure(solara_server, solara_app, extra_include_path):
+    assets_url = solara_server.base_url + "/static/assets"
+    assets_directory = solara.server.server.solara_static.parent / "assets"
+
+    with extra_include_path(HERE), solara_app("server_test:ClickButton"):
+        url = assets_url + "/theme.js"
+        response = requests.get(url)
+        assert response.status_code == 200
+        test_file = assets_directory.parent / "__init__.py"
+        assert test_file.exists()
+        url = assets_url + "/..%2f__init__.py"
+        response = requests.get(url)
+        assert response.status_code == 404
+
+        url = assets_url + "/foo/..%2f..%2f__init__.py"
+        response = requests.get(url)
+        assert response.status_code == 404
+
+
+def test_public_secure(solara_server, solara_app, extra_include_path):
+    public_url = solara_server.base_url + "/static/public"
+
+    with solara_app(str(HERE / "apps/secure/app.py")):
+        apps = list(solara.server.app.apps.values())
+        assert len(apps) == 1
+        app = apps[0]
+        public_directory = app.directory.parent / "public"
+        url = public_url + "/test.txt"
+        response = requests.get(url)
+        assert response.status_code == 200
+        test_file = public_directory.parent / "not-allowed"
+        assert test_file.exists()
+        url = public_url + "/..%2fnot-allowed"
+        response = requests.get(url)
+        assert response.status_code == 404
+
+        url = public_url + "/foo/..%2f..%2fnot-allowed"
+        response = requests.get(url)
+        assert response.status_code == 404
+
+
+def test_static_secure(solara_server, solara_app, extra_include_path):
+    static_url = solara_server.base_url + "/static"
+    static_directory = solara.server.server.solara_static
+
+    with extra_include_path(HERE), solara_app("server_test:ClickButton"):
+        url = static_url + "/main.js"
+        response = requests.get(url)
+        assert response.status_code == 200
+        test_file = static_directory.parent / "__init__.py"
+        assert test_file.exists()
+        url = static_url + "/..%2f__init__.py"
+        response = requests.get(url)
+        assert response.status_code == 404
+
+        url = static_url + "/foo/..%2f..%2f__init__.py"
+        response = requests.get(url)
+        assert response.status_code == 404

{solara_ui-1.34.1 → solara_ui-1.35.1}/tests/unit/cdn_helper_test.py

@@ -2,6 +2,9 @@ import hashlib
 import os
 from pathlib import Path
 
+from pytest import TempPathFactory
+import pytest
+
 from solara.server.cdn_helper import get_cdn_url, get_data, get_from_cache, put_in_cache, get_path
 
 
@@ -68,6 +71,26 @@ def test_get_data(tmp_path_factory):
     assert data == b"test_cached_2"
 
 
+def test_get_data_secure(tmp_path_factory: TempPathFactory):
+    # we should never be able to get data from the parent directory
+
+    root_dir = tmp_path_factory.mktemp("root")
+    base_cache_dir = root_dir / "cdn"
+    base_cache_dir.mkdir()
+
+    (root_dir / "secret").write_bytes(b"not allowed")
+
+    project_dir = base_cache_dir / "project"
+    project_dir.mkdir()
+
+    (project_dir / "file").write_bytes(b"a")
+
+    data = get_data(base_cache_dir, "project/file")
+    assert data == b"a"
+    with pytest.raises(PermissionError):
+        get_data(base_cache_dir, "project/../../secret")
+
+
 def test_redirect(tmp_path_factory):
     base_cache_dir = tmp_path_factory.mktemp("cdn")