Hello, Clearml-Server Appears To Fail Escaping Html In Stdout/Stderr Reporting (The Console View), Is This A Known Bug ? Is This Fixed On 1.13.0 Maybe ? I’M On Webapp: 1.12.0-393 • Server: 1.12.0-393 • Api: 2.26 I Print Things Like This

Answered

hello, clearml-server appears to fail escaping html in stdout/stderr reporting (the console view), is this a known bug ? is this fixed on 1.13.0 maybe ? I’m on WebApp: 1.12.0-393 • Server: 1.12.0-393 • API: 2.26
I print things like this

     np = <module 'numpy' from '/home/monk/mambaforge/envs/mathis39/lib/python3.9/site-packages/numpy/__init__.py'>
     logger = <loguru.logger handlers=[(id=1, level=10, sink=<stderr>), (id=2, level=10, sink='/shared/data/gold_standard/2023-11-22_ingestion.tmp/log.txt'), (id=3, level=10, sink='/shared/data/gold_standard/2023-11-22_ingestion.tmp/log.jsonl')]>
     DAMAGES = <Classes 1: ...>

and it completely removes the <> and the text inside in clearml console view:

     np = 
     logger = ), (id=2, level=10, sink='/shared/data/gold_standard/2023-11-22_ingestion.tmp/log.txt'), (id=3, level=10, sink='/shared/data/gold_standard/2023-11-22_ingestion.tmp/log.jsonl')]>
     DAMAGES =

and from what I can see in the page source (of the console view), the code is not removed but injected as html, serious XSS bug !
thanks

  				
Posted 
	one year ago

					More
				  		
  Report
		
					VirtuousFish83
				
					0
					 × 1

Votes Newest

Answers 2

Hi @<1523706645840924672:profile|VirtuousFish83> , can you share a code example? Or explain where exactly you're printing this?

  				
Posted 
	one year ago

					More
				  		
  Report
		
					SuccessfulKoala55
				
					0
					 × 1

ok so I reproduced it with this, it happens when I have colors (I got the error first with an exception printed with stackprinter None )

Task.init(project_name="test", task_name="test", reuse_last_task_id=False)
print("this is a test <hello world> rest of the text")
print("this is a test <hello world> rest of the text", file=sys.stderr)
print(colorama.Fore.RED + "this is a test <hello world> rest of the text" + colorama.Style.RESET_ALL)

  				
Posted 
	one year ago

					More
				  		
  Report
		
					VirtuousFish83
				
					0
					 × 1

Write your answer

779 Views

2 Answers

one year ago