External API calls to trigger JupyterLab features

Great, sounds good.

But of course, remember: untrusted code-execution-as-a-service can’t ever be made 100% safe for the machine it runs on and any machine it can connect to. Disabling terminal? Whatever, I’ll just use ! commands. Disabled those somehow? I’ll use any one of the 50 ways python gives me to run scripts. I’ll write a file out, and import it, and abuse the python loading mechanism.

See also How to control code executed in Jupyter Notebook (e.g. block malicious code execution) - #2 by bollwyvl

1 Like