HTML comments in Python docstring are not removed when rendering by streamlit #1

Activity

1. nukopy commented on Jun 10, 2020

   

   nukopy

   on Jun 10, 2020

   OwnerAuthor

   More actions

   A problem in this issue is by design for security, HTML.

   After Python docstring is parsed, it is passed to streamlit.write(body: str, unsafe_allow_html).

   write(string) :Prints the formatted Markdown string, with support for LaTeX expression and emoji shortcodes. See docs for st.markdown for more.

   Description of unsafe_allow_html is below:

   • official doc: streamlit - magic commands

   • unsafe_allow_html (bool) –
     This is a keyword-only argument that defaults to False.

   By default, any HTML tags found in strings will be escaped and therefore treated as pure text. This behavior may be turned off by setting this argument to True.

   That said, we strongly advise against it*. It is hard to write secure HTML, so by using this argument you may be compromising your users’ security. For more information, see:

   streamlit/issues/152

   Also note that unsafe_allow_html is a temporary measure and may be removed from Streamlit at any time.

   If you decide to turn on HTML anyway, we ask you to please tell us your exact use case here: https://discuss.streamlit.io/t/96.

   This will help us come up with safe APIs that allow you to do what you want.

   According to the above, HTML tags are escaped by default, so comments like <!-- md -->, <!-- end-md --> in Python docstring are treated as pure text and rendered as pure text.

   Is it better to solve this issue in Python side, not an extension side?
2. TezRomacH commented on Jul 18, 2021

   

   TezRomacH

   on Jul 18, 2021

   More actions

   Hi, @nukopy ! How is it going on this fix?
3. TezRomacH commented on Jul 18, 2021

   

   TezRomacH

   on Jul 18, 2021

   Last edited by TezRomacH

   More actions

   for now, I tried using a solution like

   from functools import partial
   import streamlit as st
   
   write_markdown = partial(st.write, unsafe_allow_html=True)
   
   write_markdown(""" <!-- md --> 
   ### Step 1: See your app
   <!-- end-md --> 
   """)

   but the extension isn't working inside functions