wip

apostrophe/insecure_file_warning.py

+# Copyright (C) 2022, Manuel Genovés <manuel.genoves@gmail.com>
+# This program is free software: you can redistribute it and/or modify it
+# under the terms of the GNU General Public License version 3, as published
+# by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranties of
+# MERCHANTABILITY, SATISFACTORY QUALITY, or FITNESS FOR A PARTICULAR
+# PURPOSE.  See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program.  If not, see <http://www.gnu.org/licenses/>.
+# END LICENSE
+
+import gi
+
+gi.require_version('Gtk', '3.0')
+from gi.repository import Gtk, Gdk, GObject, GLib, Handy
+
+import logging
+
+LOGGER = logging.getLogger('apostrophe')
+
+@Gtk.Template(resource_path='/org/gnome/gitlab/somas/Apostrophe/ui/InsecureFileWarning.ui')
+class ApostropheInsecureFileWarning(Handy.StatusPage):
+
+    __gtype_name__ = "ApostropheInsecureFileWarning"
+
+    trust_authors = GObject.Property(type=bool, default=False)
+
+    def __init__(self):
+        super().__init__()
\ No newline at end of file

apostrophe/main_window.py

@@ -29,6 +29,7 @@ from apostrophe.preview_handler import PreviewHandler
 from apostrophe.stats_handler import StatsHandler
 from apostrophe.text_view import ApostropheTextView
 from apostrophe.search_and_replace import ApostropheSearchBar
+from apostrophe.insecure_file_warning import ApostropheInsecureFileWarning
 from apostrophe.settings import Settings
 from apostrophe.tweener import Tweener
 from apostrophe.helpers import App
@@ -661,6 +662,7 @@ class File():
         self.path = ""
         self.title = ""
         self.name = ""
+        self.trusted = False
 
     @property
     def gfile(self):

apostrophe/preview_handler.py

@@ -15,6 +15,7 @@
 
 import math
 import webbrowser
+import requests
 from enum import auto, IntEnum
 
 import gi
@@ -51,7 +52,8 @@ class PreviewHandler:
         self.preview_renderer = PreviewRenderer(
             window, text_view, flap)
 
-        window.connect("style-updated", self.reload)
+        self.window = window
+        self.window.connect("style-updated", self.reload)
 
         self.text_changed_handler_id = None
 
@@ -83,9 +85,15 @@ class PreviewHandler:
             if not self.web_view:
                 self.web_view = PreviewWebView()
                 self.web_view.get_settings().set_allow_universal_access_from_file_urls(True)
+                self.web_view.get_settings().set_enable_javascript_markup(False)
                 #TODO: enable devtools on Devel profile
                 self.web_view.get_settings().set_enable_developer_extras(True)
 
+                # Allow mathjax
+                script = requests.get("https://cdn.jsdelivr.net/npm/mathjax@3/es5/tex-chtml-full.js", allow_redirects=True).text
+                webkit_script = WebKit2.UserScript.new(script, WebKit2.UserContentInjectedFrames.TOP_FRAME, WebKit2.UserScriptInjectionTime.START, None, None)
+                #self.web_view.get_user_content_manager().add_script(webkit_script)
+
                 # Show preview once the load is finished
                 self.web_view.connect("load-changed", self.on_load_changed)
 

build-aux/flatpak/org.gnome.gitlab.somas.Apostrophe.json

@@ -111,7 +111,7 @@
             "name" : "pipdeps",
             "buildsystem" : "simple",
             "build-commands" : [
-                "pip3 install --no-index --find-links=\"file://${PWD}\" --prefix=${FLATPAK_DEST} regex pypandoc chardet"
+                "pip3 install --no-index --find-links=\"file://${PWD}\" --prefix=${FLATPAK_DEST} regex pypandoc chardet certifi urllib3 charset_normalizer idna requests"
             ],
             "sources" : [
                 {
@@ -143,6 +143,31 @@
                     "type" : "file",
                     "url" : "https://files.pythonhosted.org/packages/ee/2d/9cdc2b527e127b4c9db64b86647d567985940ac3698eeabc7ffaccb4ea61/chardet-4.0.0.tar.gz",
                     "sha256" : "0d6f53a15db4120f2b08c94f11e7d93d2c911ee118b6b30a04ec3ee8310179fa"
+                },
+                {
+                    "type" : "file",
+                    "url" : "https://files.pythonhosted.org/packages/6c/ae/d26450834f0acc9e3d1f74508da6df1551ceab6c2ce0766a593362d6d57f/certifi-2021.10.8.tar.gz",
+                    "sha256" : "78884e7c1d4b00ce3cea67b44566851c4343c120abd683433ce934a68ea58872"
+                },
+                {
+                    "type" : "file",
+                    "url" : "https://files.pythonhosted.org/packages/1b/a5/4eab74853625505725cefdf168f48661b2cd04e7843ab836f3f63abf81da/urllib3-1.26.9.tar.gz",
+                    "sha256" : "aabaf16477806a5e1dd19aa41f8c2b7950dd3c746362d7e3223dbe6de6ac448e"
+                },
+                {
+                    "type" : "file",
+                    "url" : "https://files.pythonhosted.org/packages/56/31/7bcaf657fafb3c6db8c787a865434290b726653c912085fbd371e9b92e1c/charset-normalizer-2.0.12.tar.gz",
+                    "sha256" : "2857e29ff0d34db842cd7ca3230549d1a697f96ee6d3fb071cfa6c7393832597"
+                },
+                {
+                    "type" : "file",
+                    "url" : "https://files.pythonhosted.org/packages/62/08/e3fc7c8161090f742f504f40b1bccbfc544d4a4e09eb774bf40aafce5436/idna-3.3.tar.gz",
+                    "sha256" : "9d643ff0a55b762d5cdb124b8eaa99c66322e2157b69160bc32796e824360e6d"
+                },
+                {
+                    "type" : "file",
+                    "url" : "https://files.pythonhosted.org/packages/60/f3/26ff3767f099b73e0efa138a9998da67890793bfa475d8278f84a30fec77/requests-2.27.1.tar.gz",
+                    "sha256" : "68d7c56fd5a8999887728ef304a6d12edc7be74f1cfa47714fc8b414525c9a61"
                 }
             ]
         },

data/apostrophe.gresource.xml

@@ -15,6 +15,7 @@
     <file compressed="true">media/css/gtk/bindings.css</file>
     <file compressed="true" preprocess="xml-stripblanks">ui/Export.ui</file>
     <file compressed="true" preprocess="xml-stripblanks">ui/Headerbar.ui</file>
+    <file compressed="true" preprocess="xml-stripblanks">ui/InsecureFileWarning.ui</file>
     <file compressed="true" preprocess="xml-stripblanks">ui/Preferences.ui</file>
     <file compressed="true" preprocess="xml-stripblanks">ui/PreviewLayoutSwitcher.ui</file>
     <file compressed="true" preprocess="xml-stripblanks">ui/PreviewLayoutSwitcherItem.ui</file>

data/media/css/gtk/_base.scss

@@ -78,6 +78,9 @@
   background-color: mix($base_color, $bg_color, 0.5);
 }
 
+.pill-button {
+  border-radius: 100px;
+}
 
 .lexikon {
   font-family: serif;

data/ui/InsecureFileWarning.ui

+<?xml version="1.0" encoding="UTF-8"?>
+<interface>
+  <requires lib="gtk+" version="3.20"/>
+    <template class="ApostropheInsecureFileWarning" parent="HdyStatusPage">
+        <property name="name">warning</property>
+        <property name="visible">true</property>
+        <property name="title" translatable="yes">This file may be insecure</property>
+        <property name="description" translatable="yes">The file you're trying to preview seems to have embedded javascript. Previewing it might be dangerous, and only should be done if you trust the authors of the document.</property>
+        <property name="icon-name">dialog-warning-symbolic</property>
+        <child>
+            <object class="GtkBox">
+            <property name="visible">true</property>
+            <property name="orientation">vertical</property>
+            <property name="halign">center</property>
+            <property name="spacing">12</property>
+            <child>
+                <object class="GtkCheckButton" id="trust_authors_check">
+                <property name="visible">true</property>
+                <property name="label">I trust the authors of this file</property>
+                </object>
+            </child>
+            <child>
+                <object class="GtkButton">
+                <property name="visible">true</property>
+                <property name="sensitive" bind-source="trust_authors_check" bind-property="active" bind-flags="sync-create"/>
+                <property name="label" translatable="yes">Load preview</property>
+                <style>
+                    <class name="pill-button"/>
+                    <class name="destructive-action"/>
+                </style>
+                </object>
+            </child>
+            </object>
+        </child>
+    </template>
+</interface>
\ No newline at end of file

data/ui/Window.ui

@@ -93,6 +93,11 @@
                     <property name="visible">true</property>
                     <property name="hexpand">true</property>
                     <property name="transition-type">crossfade</property>
+                    <child>
+                      <object class="ApostropheInsecureFileWarning">
+                          <property name="visible">True</property>
+                      </object>
+                    </child>
                     <child>
                       <object class="GtkSpinner" id="preview_spinner">
                         <property name="visible">1</property>