HTML comments in Python docstring are not removed when rendering by streamlit

[nukopy]

Problem

HTML comments like <!-- md --> in Python docstring are not removed when rendering by streamlit. This is different than what I was expecting. We need investigate how Python docstring is rendered by streamlit.

This promblem is like below:

Solution

Maybe, we can find the solution to this problem by reading a part of docstring parser in streamlit's implementation:

• streamlit/DeltaGenerator.py(line 229 ~)
  • DeltaGenerator.text()(line 442 ~)
  • DeltaGenerator.markdown()(line 463 ~)

In addition, docstirng is treated as "magic command" in streamlit. May be there's a hint of a solution in streamlit's documentation.

How it works is simple: any time Streamlit sees either a variable or literal value on its own line, it automatically writes that to your app using st.write (which you’ll learn about later).

• official doc: streamlit

[nukopy]

A problem in this issue is by design for security, HTML.

After Python docstring is parsed, it is passed to streamlit.write(body: str, unsafe_allow_html).

write(string) :Prints the formatted Markdown string, with support for LaTeX expression and emoji shortcodes. See docs for st.markdown for more.

Description of unsafe_allow_html is below:

• official doc: streamlit - magic commands

• unsafe_allow_html (bool) –
  This is a keyword-only argument that defaults to False.

By default, any HTML tags found in strings will be escaped and therefore treated as pure text. This behavior may be turned off by setting this argument to True.

That said, we strongly advise against it*. It is hard to write secure HTML, so by using this argument you may be compromising your users’ security. For more information, see:

streamlit/issues/152

Also note that unsafe_allow_html is a temporary measure and may be removed from Streamlit at any time.

If you decide to turn on HTML anyway, we ask you to please tell us your exact use case here: https://discuss.streamlit.io/t/96.

This will help us come up with safe APIs that allow you to do what you want.

According to the above, HTML tags are escaped by default, so comments like <!-- md -->, <!-- end-md --> in Python docstring are treated as pure text and rendered as pure text.

Is it better to solve this issue in Python side, not an extension side?

[TezRomacH]

Hi, @nukopy ! How is it going on this fix?

[TezRomacH]

for now, I tried using a solution like

from functools import partial
import streamlit as st

write_markdown = partial(st.write, unsafe_allow_html=True)

write_markdown(""" <!-- md --> 
### Step 1: See your app
<!-- end-md --> 
""")

but the extension isn't working inside functions