Seeking Advice on Hardening JupyterLab 4.4.8 for Data Leakage Prevention (DLP)

JupyterLab
1

Hi everyone,

I am managing a JupyterLab 4.4.8 environment deployed within a private network. This environment serves as the sole gateway for analysts to access a highly sensitive data lake. Due to strict security policies, I must prevent any form of data exfiltration from the JupyterLab interface to the analyst’s local machine.

While I have successfully disabled the Download functionality using the settings editor and page_config.json, I am struggling with the following requirements:

  1. Disabling Copy/Paste (Clipboard Access):

    • I need to prevent users from copying text/data out of the Terminal and Notebook cells to their local clipboard.

    • Similarly, I want to restrict pasting external content into the environment to maintain integrity.

  2. Context Menu Restriction:

    • Disabling the right-click “Copy” and “Paste” options within the file browser and editor.

Since these actions are often handled by the browser’s native events or CodeMirror, standard configuration files don’t seem to offer a direct “off-switch.”

My Questions:

  • Is there a recommended way to intercept and disable these keyboard/mouse events via a Custom Extension?

  • Are there existing plugins or server-side configurations that can enforce these restrictions at the application level?

  • Has anyone implemented a similar “Data Sandbox” environment and could share architectural advice?

I would appreciate any ideas, code snippets, or pointers to relevant documentation.

Best regards,

2

The threat model is difficult to imagine here. Any semi-motivated bad actor can drop to the browser console and interact directly with the DOM, and even generally the runtime program by setting a breakpoint.

3 Likes