Vscode-jupyter: Jupyter Notebook: pictures from up directories are not shown

[dsidov]

Expected/actual behavior

I work with Jupyter Notebook in VS Code and insert picture in Markdown field.
If picture is in the same folder as .ipynb file or directory down - everything is working fine. But pictures from up directories are not shown.
Browser version of Jupyter Notebook works fine. And if I run python script in VSC and try to open file from up directories it's working too.
Is it a bug?
I changed paths & slashes, terminal paths, notebook (Python > Data Science) settings, swithed between conda and "usual" python and it doesn't help.

Steps to cause the bug to occur

For example I have project in D:/Project folder. Notebook is inside "./scriptFolder" and I'm inserting several images. Pics from notebook folder and directories down are shown, other not. With tree it looks like this:

|----dataFolder
|    |----data.txt
|    |----vsData.jpg (this pic is not shown)
|----scriptFolder
|    |----pic
|    |    |----vsDown.jpg (this pic is shown)
|    |----jNotebook.ipynb (our notebook)
|    |----vs.jpg (this pic is also shown)
|----vsUp.jpg (this pic is not shown)

I run this scripts:

# %% [markdown]
<img src="./vs.jpg" /> (shown)
<img src="./pic/vsDown.jpg" /> (shown)
<img src="./../vsUp.jpg" /> (not shown)
<img src="./../dataFolder/vsData.jpg" /> (not shown)

# %%
f = open("./../dataFolder/data.txt","r")
print(f.read()) 

GIF version

Jupyter and/or Python environment

• Jupyter server running: Local
• Extension version: Python 2020.3.71659
• VS Code version: 1.44
• Python/Anaconda version: 3.7.6(+3.8.2)/2020.02
• OS: Windows
• Virtual environment: N/A

Microsoft Data Science for VS Code Engineering Team: @rchiodo, @IanMatthewHuff, @DavidKutu, @DonJayamanne, @greazer

[rchiodo]

Yes unfortunately this is a side effect of the security model that VS code has for webview editors. Under the covers this is happening:

We may be able to add all directories in the workspace to the list of allowed folders, but that might not be practical.

[rchiodo]

Right now we allow the directory where the notebook has run from (and all subdirectories as these don't need to be explicit)

[dsidov]

Yes unfortunately this is a side effect of the security model that VS code has for webview editors.

Oh, I was thinking that problem is somewhere in ipython & compability. Thanks for explanation.

---

We may be able to add all directories in the workspace to the list of allowed folders, but that might not be practical.

Well, I agree that going several directories up and then down isn't the most exquisite way, but the data comes in this form to avoid duplicated files.
Since you can add different directories to workplace, it could be a good balance between capabilities & security. Or you'll need to rewrite the "security" kernel, which will take a huge amount of time?

---

As I understand it, there's no such way as enable-disable this security model, right?

[rchiodo]

As I understand it, there's no such way as enable-disable this security model, right?

No this is baked into VS code. It prevents unknown javascript from reading from disk.

[dsidov]

Well, no big deal then, I guess I'll use a browser for final version and make a script for correcting paths for now. Maybe you'll have light schedule and will think about it later. Thanks!

[rchiodo]

We're just about to fix it. Should be in the next week or so (or sooner if you want the insider's build of our extension)

[dsidov]

Wow, thanks a lot! You're doing a great job!

[rchiodo]

Validated. Should be in our released bits.