From c5b187c49c373421d299d673186f8a0be0c8264f Mon Sep 17 00:00:00 2001 From: itsdaxen Date: Mon, 3 Aug 2026 05:30:26 +0300 Subject: [PATCH] Convert IFrame sources to strings before HTML escaping --- IPython/lib/display.py | 2 +- tests/test_display_2.py | 7 +++++++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/IPython/lib/display.py b/IPython/lib/display.py index afe1882cf97..5da924ac241 100644 --- a/IPython/lib/display.py +++ b/IPython/lib/display.py @@ -292,7 +292,7 @@ def _repr_html_(self): else: params = "" return self.iframe.format( - src=html_escape(self.src), + src=html_escape(str(self.src)), width=html_escape(str(self.width)), height=html_escape(str(self.height)), params=params, diff --git a/tests/test_display_2.py b/tests/test_display_2.py index 43dac8fcfda..8e6fc646132 100644 --- a/tests/test_display_2.py +++ b/tests/test_display_2.py @@ -5,6 +5,7 @@ import os import sys import warnings +from pathlib import Path from unittest import mock @@ -595,6 +596,12 @@ def test_iframe_escaping(): assert 'width="400" onload="alert(1)"' in html._repr_html_() +def test_iframe_path_source(): + """IFrame: pathlib sources are converted to strings before escaping.""" + html = display.IFrame(Path("report¬es.html"), 400, 300)._repr_html_() + assert 'src="report&notes.html"' in html + + def test_image_bad_filename_raises_proper_exception(): with pytest.raises(FileNotFoundError): display.Image("/this/file/does/not/exist/")._repr_png_()