fix: isolate uploaded Markdown from application templates

1_📝_form.py

@@ -8,7 +8,6 @@ import requests
 from huggingface_hub import hf_hub_download, upload_file
 import pandas as pd
 from huggingface_hub import create_repo
-import os
 from middleMan import parse_into_jinja_markdown as pj
 
 
@@ -89,14 +88,6 @@ def validate(self, repo_type="model"):
             raise exc
 
 
-## Save uploaded [markdown] file to directory to be used by jinja parser function 
-def save_uploadedfile(uploadedfile):
-    with open(os.path.join("temp_uploaded_filed_Dir",uploadedfile.name),"wb") as f:
-        f.write(uploadedfile.getbuffer())
-    st.success("Saved File:{} to temp_uploaded_filed_Dir".format(uploadedfile.name))
-    return uploadedfile.name 
-
-
 def main_page():
 
    
@@ -166,6 +157,7 @@ def main_page():
 
             "check_box": bool,
             "markdown_upload":" ",
+            "uploaded_markdown": None,
             "legal_view":bool,
             "researcher_view":bool,
             "beginner_technical_view":bool,
@@ -229,12 +221,14 @@ def main_page():
 
         # Read a single file 
         uploaded_file = st.file_uploader("Choose a file", type = ['md'], help = 'Please choose a markdown (.md) file type to upload')
+        st.session_state.uploaded_markdown = None
         if uploaded_file is not None:
-           
-            file_details = {"FileName":uploaded_file.name,"FileType":uploaded_file.type} 
-            name_of_uploaded_file = save_uploadedfile(uploaded_file)
-           
-            st.session_state.markdown_upload = name_of_uploaded_file ## uploaded model card
+            try:
+                st.session_state.uploaded_markdown = uploaded_file.getvalue().decode("utf-8-sig")
+            except UnicodeDecodeError:
+                st.error("Please upload a UTF-8 Markdown file.")
+                st.stop()
+            st.success("Loaded Markdown for this session.")
 
         elif st.session_state.task =='fill-mask' or 'translation' or 'token-classification' or ' sentence-similarity' or 'summarization' or 'question-answering' or 'text2text-generation' or 'text-classification' or 'text-generation' or 'conversational':
             #st.session_state.markdown_upload = open(
@@ -249,9 +243,6 @@ def main_page():
         #########################################
         ### Uploading model card to HUB
         #########################################
-        out_markdown =open( st.session_state.markdown_upload, "r+"
-            ).read() 
-        print_out_final = f"{out_markdown}"
         st.markdown("## Export Loaded Model Card to Hub")
         with st.form("Upload to 🤗 Hub"):
             st.markdown("Use a token with write access from [here](https://hf.co/settings/tokens)")

middleMan.py

@@ -6,6 +6,7 @@ from markdownTagExtract import tag_checker,listToString,to_markdown
 #from specific_extraction import extract_it
 from modelcards import CardData, ModelCard
 from jinja2 import Environment, FileSystemLoader
+from pathlib import Path
 
 
 def is_float(value):
@@ -17,8 +18,16 @@ def is_float(value):
 
 ## Handles parsing jinja variable templates
 def parse_into_jinja_markdown():
-    env = Environment(loader=FileSystemLoader('.'), autoescape=True)
-    temp = env.get_template(st.session_state.markdown_upload)
+    # Imported cards are session-local data, never executable templates.
+    uploaded_markdown = st.session_state.get("uploaded_markdown")
+    if uploaded_markdown is not None:
+        return uploaded_markdown
+
+    template_name = st.session_state.markdown_upload
+    if template_name not in {"language_model_template1.md", "current_card.md"}:
+        raise ValueError("Only built-in model card templates can be rendered.")
+    env = Environment(loader=FileSystemLoader(Path(__file__).resolve().parent), autoescape=True)
+    temp = env.get_template(template_name)
     # to add: 
     # - parent model
     # to fix:
@@ -133,4 +142,4 @@ def extract_section(current_template, start_tag, end_tag):
 
 def main():
     #card.save('current_card.md')
-    return 
+    return

tests/test_markdown_rendering.py

@@ -0,0 +1,70 @@
+"""Run with: python -m unittest discover -s tests -v."""
+import os
+from pathlib import Path
+import tempfile
+from types import SimpleNamespace
+import unittest
+from unittest.mock import patch
+
+import middleMan
+
+
+class FormState(dict):
+    """Blank form fixture; named fields are supplied by each test."""
+
+    def __missing__(self, key):
+        return ""
+
+    def __getattr__(self, key):
+        return self[key]
+
+
+class MarkdownRenderingTests(unittest.TestCase):
+    def render(self, **values):
+        state = FormState(markdown_upload="language_model_template1.md", model_name="Example model")
+        state.update(values)
+        with patch.object(middleMan, "st", SimpleNamespace(session_state=state)):
+            return middleMan.parse_into_jinja_markdown()
+
+    def test_imported_markdown_preserves_literal_template_syntax(self):
+        markdown = "# My card\n\n{{ 7 * 7 }}\n{% include 'README.md' %}\n"
+        self.assertEqual(self.render(uploaded_markdown=markdown), markdown)
+
+    def test_empty_import_is_not_replaced_with_a_default_template(self):
+        self.assertEqual(self.render(uploaded_markdown=""), "")
+
+    def test_imported_markdown_is_not_shared_with_another_session(self):
+        marker = "SESSION_A_ONLY"
+        self.assertEqual(self.render(uploaded_markdown=marker), marker)
+        self.assertNotIn(marker, self.render())
+
+    def test_only_built_in_templates_can_be_loaded(self):
+        for filename in ["README.md", "../language_model_template1.md", "/tmp/card.md"]:
+            with self.subTest(filename=filename), self.assertRaises(ValueError):
+                self.render(markdown_upload=filename)
+
+    def test_built_in_templates_still_render_form_fields(self):
+        for filename in ["language_model_template1.md", "current_card.md"]:
+            with self.subTest(filename=filename):
+                content = self.render(markdown_upload=filename)
+                self.assertIn("Example model", content)
+                self.assertNotIn("{{ model_id }}", content)
+
+    def test_form_values_are_data_even_for_built_in_templates(self):
+        self.assertIn("{{ 7 * 7 }}", self.render(model_name="{{ 7 * 7 }}"))
+
+    def test_working_directory_cannot_shadow_built_in_templates(self):
+        original_directory = Path.cwd()
+        with tempfile.TemporaryDirectory() as directory:
+            Path(directory, "language_model_template1.md").write_text("SHADOW_TEMPLATE")
+            try:
+                os.chdir(directory)
+                content = self.render()
+            finally:
+                os.chdir(original_directory)
+        self.assertNotIn("SHADOW_TEMPLATE", content)
+        self.assertIn("Example model", content)
+
+
+if __name__ == "__main__":
+    unittest.main()