Skip to content

fix: GenAI Client(evals) - replace < with \u003c > with \u003e in <script> to avoid cloud risks #6123

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
copybara-service wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix: GenAI Client(evals) - replace < with \u003c > with \u003e in <script> to avoid cloud risks #6123

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions vertexai/_genai/_evals_visualization.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,11 @@ def _pydantic_serializer(obj: Any) -> Any:
raise TypeError(f"Object of type {obj.__class__.__name__} is not JSON serializable")


def _escape_json_for_html(json_str: str) -> str:
"""Escapes characters for embedding JSON in a JS script tag to prevent XSS."""
return json_str.replace("<", "\\u003c").replace(">", "\\u003e")


def _preprocess_df_for_json(df: Optional[pd.DataFrame]) -> Optional[pd.DataFrame]:
"""Prepares a DataFrame for JSON serialization by converting complex objects to strings."""
if df is None:
Expand Down Expand Up @@ -80,6 +85,8 @@ def stringify_cell(cell: Any) -> Optional[str]:

def _get_evaluation_html(eval_result_json: str) -> str:
"""Returns a self-contained HTML for single evaluation visualization."""
# Escape characters for embedding JSON in JS script tag to prevent XSS.
eval_result_json = _escape_json_for_html(eval_result_json)
return f"""
<!DOCTYPE html>
<html>
Expand Down Expand Up @@ -556,6 +563,8 @@ def _get_evaluation_html(eval_result_json: str) -> str:

def _get_comparison_html(eval_result_json: str) -> str:
"""Returns a self-contained HTML for a side-by-side eval comparison."""
# Escape characters for embedding JSON in JS script tag to prevent XSS.
eval_result_json = _escape_json_for_html(eval_result_json)
return f"""
<!DOCTYPE html>
<html>
Expand Down Expand Up @@ -696,6 +705,8 @@ def _get_comparison_html(eval_result_json: str) -> str:

def _get_inference_html(dataframe_json: str) -> str:
"""Returns a self-contained HTML for displaying inference results."""
# Escape characters for embedding JSON in JS script tag to prevent XSS.
dataframe_json = _escape_json_for_html(dataframe_json)
return f"""
<!DOCTYPE html>
<html>
Expand Down
Loading