Skip to content

fix: allow for data-uris in mpl-interactive and marimo-panel after a cell has run#9196

Merged
mscolnick merged 2 commits intomainfrom
ms/allow-for-data-uris
Apr 16, 2026
Merged

fix: allow for data-uris in mpl-interactive and marimo-panel after a cell has run#9196
mscolnick merged 2 commits intomainfrom
ms/allow-for-data-uris

Conversation

@mscolnick
Copy link
Copy Markdown
Contributor

@mscolnick mscolnick commented Apr 14, 2026

This PR updates the logic for trusting virtual file URLs in marimo plugins, allowing data uri after some cell has been run that use inline base64 data URLs (WASM and VS Code runtimes)

Copilot AI review requested due to automatic review settings April 14, 2026 20:56
@vercel
Copy link
Copy Markdown

vercel Bot commented Apr 14, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
marimo-docs Ready Ready Preview, Comment Apr 15, 2026 4:31pm

Request Review

Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the frontend trusted-URL validation used by plugins (e.g., mpl-interactive, Panel) so that, in environments without backend virtual-file serving (WASM/VS Code), base64 data: URLs can be treated as trusted only after the user has run at least one cell (matching the same “user has executed code” trust signal used for HTML sanitization behavior).

Changes:

  • Extend isTrustedVirtualFileUrl to accept specific base64 data: URLs (JS/CSS) gated on hasRunAnyCellAtom.
  • Add Vitest coverage for the new data-URL behavior (accepted after a cell run; rejected otherwise and for unsafe types/forms).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File Description
frontend/src/plugins/core/trusted-url.ts Adds gated support for safe base64 data: URLs in trusted virtual-file URL checks.
frontend/src/plugins/core/test/trusted-url.test.ts Adds tests verifying data-URL acceptance/rejection depending on whether any cell has run.

Comment thread frontend/src/plugins/core/__test__/trusted-url.test.ts Outdated
Copy link
Copy Markdown
Collaborator

@manzt manzt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice fix. For the extension -> extensionUrl change in the plugin, would you be down to just upgrade the front end to accept either in the zod schema? Otherwise, we can just bump minimum-kernel-version in marimo-lsp.

@mscolnick mscolnick merged commit 688afd5 into main Apr 16, 2026
30 of 31 checks passed
@mscolnick mscolnick deleted the ms/allow-for-data-uris branch April 16, 2026 20:57
@github-actions
Copy link
Copy Markdown

🚀 Development release published. You may be able to view the changes at https://marimo.app?v=0.23.2-dev40

manzt added a commit to marimo-team/marimo-lsp that referenced this pull request Apr 21, 2026
Fixes #490

marimo 0.23.2 (marimo-team/marimo#9196) re-allows plugins to load base64
`data:` URIs, but only once `hasRunAnyCellAtom` is `true`,and that atom
only flips inside marimo's `useRunCells` hook, which our renderer never
calls (cells run through VS Code's NotebookController). Seed it at
`initialize()` so holoviews/bokeh and anywidget-backed outputs like
polars tables stop failing with "Refusing to load … from untrusted URL".

Workspace trust and extension ownership of the kernel are used as the
signal the atom is standing in for.
manzt added a commit to marimo-team/marimo-lsp that referenced this pull request Apr 21, 2026
Fixes #490

marimo 0.23.2 (marimo-team/marimo#9196) re-allows plugins to load base64
`data:` URIs, but only once `hasRunAnyCellAtom` is `true`,and that atom
only flips inside marimo's `useRunCells` hook, which our renderer never
calls (cells run through VS Code's NotebookController). Seed it at
`initialize()` so holoviews/bokeh and anywidget-backed outputs like
polars tables stop failing with "Refusing to load … from untrusted URL".

Workspace trust and extension ownership of the kernel are used as the
signal the atom is standing in for.
manzt added a commit to marimo-team/marimo-lsp that referenced this pull request Apr 21, 2026
Fixes #490

marimo 0.23.2 (marimo-team/marimo#9196) re-allows plugins to load base64
`data:` URIs, but only once `hasRunAnyCellAtom` is `true`,and that atom
only flips inside marimo's `useRunCells` hook, which our renderer never
calls (cells run through VS Code's NotebookController). Seed it at
`initialize()` so holoviews/bokeh and anywidget-backed outputs like
polars tables stop failing with "Refusing to load … from untrusted URL".

Workspace trust and extension ownership of the kernel are used as the
signal the atom is standing in for.
manzt added a commit to marimo-team/marimo-lsp that referenced this pull request Apr 21, 2026
Fixes #490

marimo 0.23.2 (marimo-team/marimo#9196) re-allows plugins to load base64
`data:` URIs, but only once `hasRunAnyCellAtom` is `true`,and that atom
only flips inside marimo's `useRunCells` hook, which our renderer never
calls (cells run through VS Code's NotebookController). Seed it at
`initialize()` so holoviews/bokeh and anywidget-backed outputs like
polars tables stop failing with "Refusing to load … from untrusted URL".

Workspace trust and extension ownership of the kernel are used as the
signal the atom is standing in for.
manzt added a commit to marimo-team/marimo-lsp that referenced this pull request Apr 21, 2026
Fixes #490

marimo 0.23.2 (marimo-team/marimo#9196) re-allows plugins to load base64
`data:` URIs, but only once `hasRunAnyCellAtom` is `true`,and that atom
only flips inside marimo's `useRunCells` hook, which our renderer never
calls (cells run through VS Code's NotebookController). Seed it at
`initialize()` so holoviews/bokeh and anywidget-backed outputs like
polars tables stop failing with "Refusing to load … from untrusted URL".

Workspace trust and extension ownership of the kernel are used as the
signal the atom is standing in for.
manzt added a commit to marimo-team/marimo-lsp that referenced this pull request Apr 21, 2026
Fixes #490

marimo 0.23.2 (marimo-team/marimo#9196) re-allows plugins to load base64
`data:` URIs, but only once `hasRunAnyCellAtom` is `true`,and that atom
only flips inside marimo's `useRunCells` hook, which our renderer never
calls (cells run through VS Code's NotebookController). Seed it at
`initialize()` so holoviews/bokeh and anywidget-backed outputs like
polars tables stop failing with "Refusing to load … from untrusted URL".

Workspace trust and extension ownership of the kernel are used as the
signal the atom is standing in for.
manzt added a commit to marimo-team/marimo-lsp that referenced this pull request Apr 21, 2026
Fixes #490

marimo 0.23.1 renamed the Panel plugin's `extension` field to
`extensionUrl` and started rejecting the `data:` URI fallback that VS
Code's kernel relies on (`virtual_files_supported=False`), breaking
holoviews/bokeh with "Invalid input: expected string, received
undefined".

0.23.2 re-allows `data:` URIs (marimo-team/marimo#9196); the dependency
bump picks up the new schema. Raise the compatibility floor since both
halves are needed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants