block non front-end variables (#2724)

* block non front-end variables
closes #2723

* Update taipy/gui/_renderers/builder.py

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* tests

* import Gui

* let it go when in custom page context (ie designer & co.)

* no need

* Fab's suggestion

---------

Co-authored-by: Fred Lefévère-Laoide <Fred.Lefevere-Laoide@Taipy.io>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Author: 3 people

taipy/gui/_renderers/builder.py

@@ -222,12 +222,9 @@ def __set_dynamic_any_attribute(self, name: str, default_value: t.Optional[str]
         if hash := self.__hashes.get(name):
             if isinstance(value, (dict, _MapDict)):
                 hash = self.__get_typed_hash_name(hash, PropertyType.dynamic_dict)
-                react_name = _to_camel_case(name)
-                self.__update_vars.append(f"{react_name}={hash}")
-                self.__set_react_attribute(react_name, hash)
-            else:
-                self.__update_vars.append(f"{name}={hash}")
-                self.__set_react_attribute(name, hash)
+            react_name = _to_camel_case(name)
+            self.__update_vars.append(f"{react_name}={hash}")
+            self.__set_react_attribute(react_name, hash)
         return self
 
     def __get_boolean_attribute(self, name: str, default_value=False):
@@ -243,7 +240,7 @@ def __set_boolean_attribute(self, name: str, value: bool):
             name (str): The property name.
             value (bool): the boolean value.
         """
-        return self.__set_react_attribute(_to_camel_case(name), value)
+        return self.__set_react_attribute(_to_camel_case(name), value, is_var=False)
 
     def __set_dynamic_bool_attribute(self, name: str, def_val: t.Any, with_update: bool, update_main=True):
         value = self.__get_boolean_attribute(name, def_val)
@@ -253,12 +250,13 @@ def __set_dynamic_bool_attribute(self, name: str, def_val: t.Any, with_update: b
             self.__set_boolean_attribute(default_name, value)
         if hash is not None:
             hash = self.__get_typed_hash_name(hash, PropertyType.dynamic_boolean)
-            self.__set_react_attribute(_to_camel_case(name), _get_client_var_name(hash))
+            react_name = _to_camel_case(name)
+            self.__set_react_attribute(react_name, hash, client_var_name=True)
             if with_update:
                 if update_main:
                     self.__set_update_var_name(hash)
                 else:
-                    self.__update_vars.append(f"{_to_camel_case(name)}={hash}")
+                    self.__update_vars.append(f"{react_name}={hash}")
 
     def __set_number_attribute(
         self, name: str, default_value: t.Optional[str] = None, optional: t.Optional[bool] = True
@@ -289,7 +287,7 @@ def __set_number_attribute(
             raise ValueError(
                 f"Property {name} expects a number for control {self.__control_type}, received {type(value)}"
             )
-        return self.__set_react_attribute(_to_camel_case(name), val)
+        return self.__set_react_attribute(_to_camel_case(name), val, is_var=False)
 
     def __set_dynamic_number_attribute(self, var_name: str, default_value: t.Any):
         value = self.__prop_values.get(var_name)
@@ -302,7 +300,7 @@ def __set_dynamic_number_attribute(self, var_name: str, default_value: t.Any):
                 _warn(f"{self.__element_name}: {var_name} cannot be transformed into a number", e)
                 value = 0
         if isinstance(value, numbers.Number):
-            self.__set_react_attribute(_to_camel_case(f"default_{var_name}"), value)
+            self.__set_react_attribute(_to_camel_case(f"default_{var_name}"), value, is_var=False)
         elif value is not None:
             _warn(f"{self.__element_name}: {var_name} value is not valid ({value}).")
         if hash := self.__hashes.get(var_name):
@@ -343,7 +341,7 @@ def __set_string_or_number_attribute(self, name: str, default_value: t.Optional[
         if value is None:
             return self
         if isinstance(value, numbers.Number):
-            return self.__set_react_attribute(_to_camel_case(name), value)
+            return self.__set_react_attribute(_to_camel_case(name), value, is_var=False)
         else:
             return self.set_attribute(_to_camel_case(name), value)
 
@@ -456,15 +454,21 @@ def __set_function_attribute(
             if value is None:
                 return self
         elif _is_boolean(value) and not _is_true(t.cast(str, value)):
-            return self.__set_react_attribute(_to_camel_case(name), False)
+            return self.__set_react_attribute(_to_camel_case(name), False, is_var=False)
         elif value:
             value = str(value)
             func = self.__gui._get_user_function(value)  # type: ignore[attr-defined]
             if func == value:
                 _warn(f"{self.__control_type}.{name}: {value} is not a function.")
         return self.set_attribute(_to_camel_case(name), value) if value else self
 
-    def __set_react_attribute(self, name: str, value: t.Any):
+    def __set_react_attribute(
+        self, name: str, value: t.Any, is_var: t.Optional[bool] = True, client_var_name: t.Optional[bool] = False
+    ):
+        if is_var and isinstance(value, str):
+            self.__gui._add_front_end_variable(value)
+            if client_var_name:
+                value = _get_client_var_name(value)
         return self.set_attribute(name, "{!" + (str(value).lower() if isinstance(value, bool) else str(value)) + "!}")
 
     @staticmethod
@@ -665,10 +669,7 @@ def _get_dataframe_attributes(self) -> "_Builder":
             self.__set_json_attribute("defaultColumns", col_dict)
         if cmp_hash:
             hash_name = self.__get_typed_hash_name(cmp_hash, PropertyType.data)
-            self.__set_react_attribute(
-                _to_camel_case("data"),
-                _get_client_var_name(hash_name),
-            )
+            self.__set_react_attribute(_to_camel_case("data"), hash_name, client_var_name=True)
             self.__set_update_var_name(hash_name)
             self.__set_boolean_attribute("compare", True)
             self.__set_string_attribute("on_compare")
@@ -721,7 +722,7 @@ def _get_chart_config(self, default_type: str, default_mode: str):
             while add_data_hash := self.__hashes.get(name_idx):
                 typed_hash = self.__get_typed_hash_name(add_data_hash, _TaipyData)
                 data_updates.append(typed_hash)
-                self.__set_react_attribute(f"data{data_idx}", _get_client_var_name(typed_hash))
+                self.__set_react_attribute(f"data{data_idx}", typed_hash, client_var_name=True)
                 add_data = self.__prop_values.get(name_idx)
                 data_idx += 1
                 name_idx = f"data[{data_idx}]"
@@ -797,12 +798,13 @@ def _get_list_attribute(self, name: str, list_type: PropertyType):
                 else:
                     list_val = [str(v) for v in list_val]
                 if list_val:
-                    self.__set_react_attribute(_to_camel_case(name), list_val)
+                    self.__set_react_attribute(_to_camel_case(name), list_val, is_var=False)
             elif list_val is not None:
-                    _warn(f"{self.__element_name}: {name} should be a list.")
+                _warn(f"{self.__element_name}: {name} should be a list.")
         else:
-            self.__set_react_attribute(_to_camel_case(name), hash_name)
-            self.__update_vars.append(f"{_to_camel_case(name)}={hash_name}")
+            react_name = _to_camel_case(name)
+            self.__set_react_attribute(react_name, hash_name)
+            self.__update_vars.append(f"{react_name}={hash_name}")
         return self
 
     def __set_class_names(self):
@@ -838,10 +840,7 @@ def _set_content(self, var_name: str = "content", image=True):
         if hash_name:
             hash_name = self.__get_typed_hash_name(hash_name, PropertyType.image if image else PropertyType.content)
         if hash_name:
-            self.__set_react_attribute(
-                var_name,
-                _get_client_var_name(hash_name),
-            )
+            self.__set_react_attribute(var_name, hash_name, client_var_name=True)
         return self.set_attribute(_to_camel_case(f"default_{var_name}"), value)
 
     def __set_default_value(
@@ -859,9 +858,9 @@ def __set_default_value(
         elif isinstance(value, str):
             return self.set_attribute(default_var_name, value)
         elif native_type and isinstance(value, numbers.Number):
-            return self.__set_react_attribute(default_var_name, value)
+            return self.__set_react_attribute(default_var_name, value, is_var=False)
         elif value is None:
-            return self.__set_react_attribute(default_var_name, "null")
+            return self.__set_react_attribute(default_var_name, "null", is_var=False)
         elif var_type == PropertyType.lov_value:
             # Done by _get_adapter
             return self
@@ -901,7 +900,7 @@ def set_value_and_default(
                 var_type = PropertyType.lov_value
                 native_type = False
             elif var_type == PropertyType.toggle_value:
-                self.__set_react_attribute(_to_camel_case("is_switch"), True)
+                self.__set_react_attribute(_to_camel_case("is_switch"), True, is_var=False)
                 var_type = PropertyType.dynamic_boolean
                 native_type = True
             else:
@@ -915,10 +914,7 @@ def set_value_and_default(
             return self.set_attributes([(var_name, var_type, bool(default_val), with_update)])
         if hash_name := self.__hashes.get(var_name):
             hash_name = self.__get_typed_hash_name(hash_name, var_type)
-            self.__set_react_attribute(
-                _to_camel_case(var_name),
-                _get_client_var_name(hash_name),
-            )
+            self.__set_react_attribute(_to_camel_case(var_name), hash_name, client_var_name=True)
             if with_update:
                 self.__set_update_var_name(hash_name)
             if with_default:
@@ -940,7 +936,7 @@ def set_value_and_default(
                         with contextlib.suppress(Exception):
                             value = float(value)
                     if isinstance(value, (int, float)):
-                        return self.__set_react_attribute(_to_camel_case(var_name), value)
+                        return self.__set_react_attribute(_to_camel_case(var_name), value, is_var=False)
                 if isinstance(value, (datetime, date, time)):
                     value = _date_to_string(value)
                 self.set_attribute(_to_camel_case(var_name), value)
@@ -949,7 +945,7 @@ def set_value_and_default(
     def _set_labels(self, var_name: str = "labels"):
         if value := self.__prop_values.get(var_name):
             if _is_true(value):
-                return self.__set_react_attribute(_to_camel_case(var_name), True)
+                return self.__set_react_attribute(_to_camel_case(var_name), True, is_var=False)
             elif isinstance(value, (dict, _MapDict)):
                 return self.__set_dict_attribute(var_name)
         return self
@@ -962,8 +958,8 @@ def _set_partial(self):
                 _warn(f"{self.__element_name} control: page and partial should not be both defined.")
             if isinstance(partial, Partial):
                 self.__prop_values["page"] = partial._route
-                self.__set_react_attribute("partial", partial._route)
-                self.__set_react_attribute("defaultPartial", True)
+                self.__set_react_attribute("partial", partial._route, is_var=False)
+                self.__set_react_attribute("defaultPartial", True, is_var=False)
         return self
 
     def _set_propagate(self):
@@ -1016,7 +1012,7 @@ def __set_dynamic_property_without_default(
         else:
             hash_name = self.__get_typed_hash_name(hash_name, property_type)
             self.__update_vars.append(f"{_to_camel_case(name)}={hash_name}")
-            self.__set_react_attribute(_to_camel_case(name), _get_client_var_name(hash_name))
+            self.__set_react_attribute(_to_camel_case(name), hash_name, client_var_name=True)
         return self
 
     def __set_html_content(self, name: str, property_name: str, property_type: PropertyType):
@@ -1034,7 +1030,7 @@ def __set_html_content(self, name: str, property_name: str, property_type: Prope
                 },
             ),
         )
-        return self.__set_react_attribute(_to_camel_case(property_name), _get_client_var_name(front_var))
+        return self.__set_react_attribute(_to_camel_case(property_name), front_var, client_var_name=True)
 
     def _set_indexed_icons(self, name="use_icon"):
         global_icon = self.__prop_values.get(name)
@@ -1134,7 +1130,7 @@ def set_attributes(self, attributes: t.List[tuple]):  # noqa: C901
                     self.__set_react_attribute(prop_name, hash_name)
                 else:
                     self.__set_react_attribute(
-                        prop_name, self.__prop_values.get(attr[0], _get_tuple_val(attr, 2, None))
+                        prop_name, self.__prop_values.get(attr[0], _get_tuple_val(attr, 2, None)), is_var=False
                     )
             elif var_type == PropertyType.broadcast:
                 self.__set_react_attribute(

taipy/gui/gui.py

@@ -85,7 +85,6 @@
     _hasscopeattr,
     _is_function,
     _is_in_notebook,
-    _is_plotly_figure,
     _is_unnamed_function,
     _LocalsContext,
     _MapDict,
@@ -446,8 +445,11 @@ def __init__(
             ]
         )
 
+        # Init Event Manager
         self.__event_manager = _EventManager()
 
+        self.__front_end_variables: t.Set[str] = set()
+
         # Init Gui Hooks
         _Hooks()._init(self)
 
@@ -1182,9 +1184,13 @@ def __send_var_list_update(  # noqa C901
                 modified_vars.remove(v.get_name())
             elif isinstance(v, _DoNotUpdate):
                 modified_vars.remove(k)
+        custom_page_filtered_types = _Hooks()._get_resource_handler_data_layer_supported_types()
+        in_custom_page_context = _Hooks()._is_in_custom_page_context()
         for _var in modified_vars:
+            if not self.__is_front_end_variable(_var) and not in_custom_page_context:
+                _TaipyLogger._get_logger().debug(f"Skipping variable '{_var}' not in front-end.")
+                continue
             newvalue = values.get(_var)
-            custom_page_filtered_types = _Hooks()._get_resource_handler_data_layer_supported_types()
             if isinstance(newvalue, (_TaipyData)) or (
                 custom_page_filtered_types and isinstance(newvalue, custom_page_filtered_types)
             ):  # type: ignore
@@ -1211,9 +1217,7 @@ def __send_var_list_update(  # noqa C901
                     is_json = isinstance(newvalue, _TaipyToJson)
                     newvalue = newvalue.get()
                 # Skip in taipy-gui, available in custom frontend
-                if isinstance(newvalue, (dict, _MapDict)) and not _Hooks()._is_in_custom_page_context():
-                    continue
-                if _is_plotly_figure(newvalue):
+                if isinstance(newvalue, (dict, _MapDict)) and not in_custom_page_context:
                     continue
                 if isinstance(newvalue, float) and math.isnan(newvalue):
                     # do not let NaN go through json, it is not handle well (dies silently through websocket)
@@ -3107,3 +3111,9 @@ def __do_fire_event(
         finally:
             if this_sid:
                 get_server_request_accessor(self).set_sid(this_sid)
+
+    def _add_front_end_variable(self, var_name: str):
+        self.__front_end_variables.add(var_name)
+
+    def __is_front_end_variable(self, var_name: str) -> bool:
+        return var_name in self.__front_end_variables

tests/gui/gui_specific/test_front_end_variables.py

@@ -0,0 +1,26 @@
+# Copyright 2021-2025 Avaiga Private Limited
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+#        http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+# an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations under the License.
+
+
+from taipy.gui import Gui, Markdown
+
+
+def test_variable_binding(helpers, gui_server):
+    x = "a string"  # noqa: F841
+    gui = Gui(server=gui_server)
+    gui.add_page("test", Markdown("<|{not x}|>"))
+    gui.run(run_server=False, single_client=True)
+    client = gui._server.test_client()
+    client.get(f"/{Gui._JSX_URL}/test")
+    fv_set = gui._Gui__front_end_variables # type: ignore[reportAttributeAccessIssue]
+    assert len(fv_set) == 1
+    assert "x" not in fv_set
+    helpers.test_cleanup()

tests/gui/gui_specific/test_multiple_instances.py

@@ -25,7 +25,7 @@ def test_multiple_instance(gui_server, helpers):
 
 
 def assert_multiple_instance(gui, client, helpers, expected_value):
-    response = client.get("/taipy-jsx/TaiPy_root_page")
+    response = client.get(f"/{Gui._JSX_URL}/TaiPy_root_page")
     response_data = helpers.get_response_data(response, gui)
     assert response.status_code == 200
     assert isinstance(response_data, dict)

tests/gui/gui_specific/test_run_thread.py

@@ -23,11 +23,11 @@ def test_run_thread(gui: Gui, helpers):
     gui.run(run_in_thread=True, run_browser=False)
     while not helpers.port_check():
         time.sleep(0.1)
-    assert ">first page</h1>" in urlopen("http://127.0.0.1:5000/taipy-jsx/page1").read().decode("utf-8")
+    assert ">first page</h1>" in urlopen(f"http://127.0.0.1:5000/{Gui._JSX_URL}/page1").read().decode("utf-8")
     gui.stop()
     while helpers.port_check():
         time.sleep(0.1)
     gui.run(run_in_thread=True, run_browser=False)
     while not helpers.port_check():
         time.sleep(0.1)
-    assert ">first page</h1>" in urlopen("http://127.0.0.1:5000/taipy-jsx/page1").read().decode("utf-8")
+    assert ">first page</h1>" in urlopen(f"http://127.0.0.1:5000/{Gui._JSX_URL}/page1").read().decode("utf-8")

tests/gui/gui_specific/test_variable_binding.py

@@ -28,13 +28,13 @@ def another_function(gui):
     gui.add_page("test", Markdown("<|{x}|> | <|{y}|> | <|{z}|button|on_action=another_function|>"))
     gui.run(run_server=False, single_client=True)
     client = gui._server.test_client()
-    response = client.get("/taipy-jsx/test")
+    response = client.get(f"/{Gui._JSX_URL}/test")
     jsx = helpers.get_response_data(response, gui)["jsx"]
     for expected in ["<Button", 'defaultLabel="button label"', "label={tpec_TpExPr_z_TPMDL_0}"]:
         assert expected in jsx
-    assert gui._bindings().x == x
-    assert gui._bindings().y == y
-    assert gui._bindings().z == z
+    assert gui._bindings().x == x # type: ignore[reportAttributeAccessIssue]
+    assert gui._bindings().y == y # type: ignore[reportAttributeAccessIssue]
+    assert gui._bindings().z == z # type: ignore[reportAttributeAccessIssue]
     with gui.get_app_context():
         assert callable(gui._get_user_function("another_function"))
     helpers.test_cleanup()
@@ -47,7 +47,7 @@ def test_properties_binding(helpers, gui_server):
     gui.add_page("test", Markdown("<|button|properties=button_properties|>"))
     gui.run(run_server=False)
     client = gui._server.test_client()
-    response = client.get("/taipy-jsx/test")
+    response = client.get(f"/{Gui._JSX_URL}/test")
     jsx = helpers.get_response_data(response, gui)["jsx"]
     for expected in ["<Button", 'defaultLabel="A nice button"']:
         assert expected in jsx
@@ -62,7 +62,7 @@ def test_dict_binding(helpers, gui_server):
     gui = Gui("<|{d.k}|>", server=gui_server)
     gui.run(run_server=False)
     client = gui._server.test_client()
-    response = client.get("/taipy-jsx/TaiPy_root_page")
+    response = client.get(f"/{Gui._JSX_URL}/TaiPy_root_page")
     jsx = helpers.get_response_data(response, gui)["jsx"]
     for expected in ["<Field", 'defaultValue="test"']:
         assert expected in jsx