Security in Jupyter
Jupyter notebooks are created in order to be shared with other users, in many cases over the Internet. However, Jupyter notebooks can execute arbitrary code and generate arbitrary code. This can be a problem if malicious aspects have been placed in a notebook. The default security mechanisms for Jupyter notebooks include the following:
- Raw HTML is always sanitized (checked for malicious coding). Further information can be found at https://developers.google.com/caja.
- You cannot run external JavaScript.
- Cell contents (especially HTML and JavaScript) are not trusted (requires user validation to continue).
- The output from any cell is not trusted.
- All other HTML or JavaScript is never trusted. Clearing the output will cause the notebook to become trusted when saved.
Security digest
Notebooks can also use a security digest to ensure the correct user is modifying the contents. A digest takes into account the entire contents of the notebook and a secret (only known by the notebook creator). This combination ensures that malicious coding is not going to be added to a notebook.
You add a security digest to a notebook using the following command:
~/.jupyter/profile_default/security/notebook_secret
Here, you replace the notebook_secret part with your secret.
Trust options
You can specifically apply your trust to a notebook using a command-line option:
jupyter trust /path/to/notebook.ipynb
Or you can do it once the notebook is opened by the File | Trusted Notebook menu option.
