Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: escape HTML characters in config visualization #1227

Merged
merged 2 commits into from
Nov 14, 2024
Merged

fix: escape HTML characters in config visualization #1227

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0106684
escaped unsafe HTML character for config values in viz
zilto Nov 13, 2024
132afaf
escape HTML characters after truncation
zilto Nov 13, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 12 additions & 2 deletions hamilton/graph.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@
Note: one should largely consider the code in this module to be "private".
"""

import html
import inspect
import logging
import os.path
Expand Down Expand Up @@ -235,6 +236,7 @@ def create_graphviz_graph(
:return: a graphviz.Digraph; use this to render/save a graph representation.
"""
PATH_COLOR = "red"
MAX_STRING_LENGTH = 80

import graphviz

Expand Down Expand Up @@ -270,7 +272,16 @@ def _get_node_label(
if type_string is None:
type_string = get_type_as_string(n.type) if get_type_as_string(n.type) else ""

return f"<<b>{name}</b><br /><br /><i>{type_string}</i>>"
# We need to ensure that name and type string are HTML-escaped
# strings to avoid syntax errors. This is particular important
# because config *values* are passed through this function
# see issue: https://github.com/DAGWorks-Inc/hamilton/issues/1200
# see graphviz ref: https://graphviz.org/doc/info/shapes.html#html
if len(type_string) > MAX_STRING_LENGTH:
type_string = type_string[:MAX_STRING_LENGTH] + "[...]"

escaped_type_string = html.escape(type_string, quote=True)
return f"<<b>{name}</b><br /><br /><i>{escaped_type_string}</i>>"

def _get_input_label(input_nodes: FrozenSet[node.Node]) -> str:
"""Get a graphviz HTML-like node label formatted aspyer a table.
Expand Down Expand Up @@ -372,7 +383,6 @@ def _get_edge_style(from_type: str, to_type: str) -> Dict:
Graphviz needs values to be strings.
"""
edge_style = dict()

if from_type == "expand":
edge_style.update(
dir="both",
Expand Down