[D] Superset V6.0 - Table chart now longer shows bold text with HTML tag in columns [superset]

["Moosheimer (via GitHub)" <gi...@apache.org>]

GitHub user Moosheimer created a discussion: Superset V6.0 - Table chart now longer shows bold text with HTML <b> tag in columns

Up to Superset v6.0, text such as <b>Test</b> was displayed in bold in table columns (if ‘Render columns in HTML format’ was checked). Since v6.0, this is no longer the case.
Is this a bug or a feature?

GitHub link: https://github.com/apache/superset/discussions/36799

----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

[Re: [D] Superset V6.0 - Table chart now longer shows bold text with HTML tag in columns [superset] Posted by "Moosheimer (via GitHub)" <gi...@apache.org>.GitHub user Moosheimer added a comment to the discussion: Superset V6.0 - Table chart now longer shows bold text with HTML <b> tag in columns @dosu Your feature suggestions are already very good. But how can I create a “feature suggestion”? Your instructions on how to change the code are good. However, I am not a Python or TypeScript developer. I am using an installed Superset (Miniconda and pip3 install). Is there another way I can change this? GitHub link: https://github.com/apache/superset/discussions/36799#discussioncomment-15328086 ---- This is an automatically sent email for notifications@superset.apache.org. To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org --------------------------------------------------------------------- To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org For additional commands, e-mail: notifications-help@superset.apache.org Re: [D] Superset V6.0 - Table chart now longer shows bold text with HTML tag in columns [superset] Posted by "Moosheimer (via GitHub)" <gi...@apache.org>.GitHub user Moosheimer added a comment to the discussion: Superset V6.0 - Table chart now longer shows bold text with HTML <b> tag in columns @dosu Wow. That's tough. I read text from the database and display it in a table. The texts already have HTML tags such as &lt;b&gt;. This is extremely important because the text from the database is already tagged and should be displayed that way. Is there no way to turn that off? GitHub link: https://github.com/apache/superset/discussions/36799#discussioncomment-15326618 ---- This is an automatically sent email for notifications@superset.apache.org. To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org --------------------------------------------------------------------- To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org For additional commands, e-mail: notifications-help@superset.apache.org Re: [D] Superset V6.0 - Table chart now longer shows bold text with HTML tag in columns [superset] Posted by "Moosheimer (via GitHub)" <gi...@apache.org>.GitHub user Moosheimer edited a comment on the discussion: Superset V6.0 - Table chart now longer shows bold text with HTML <b> tag in columns Wow. That's tough. I read text from the database and display it in a table. The texts already have HTML tags such as &lt;b&gt;. This is extremely important because the text from the database is already tagged and should be displayed that way. Is there no way to turn that off? GitHub link: https://github.com/apache/superset/discussions/36799#discussioncomment-15322556 ---- This is an automatically sent email for notifications@superset.apache.org. To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org --------------------------------------------------------------------- To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org For additional commands, e-mail: notifications-help@superset.apache.org Re: [D] Superset V6.0 - Table chart now longer shows bold text with HTML tag in columns [superset] Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.GitHub user dosubot[bot] edited a comment on the discussion: Superset V6.0 - Table chart now longer shows bold text with HTML <b> tag in columns <!-- Answer --> Strict HTML sanitization in Superset is enforced to prevent XSS vulnerabilities, even for tags like `<b>` and `<li>`, because any HTML tag—if not properly sanitized—can be abused for script injection or layout manipulation, especially in environments where user input is not fully controlled. This is why Superset’s frontend only allows a limited set of tags (like `<span>`, `<img>`, `<a>`, table elements) and excludes others, regardless of backend config or intranet deployment [source](https://github.com/apache/superset/issues/36779). Currently, there’s no supported way to disable or fully customize frontend sanitization for table/chart cells; backend settings like `HTML_SANITIZATION_SCHEMA_EXTENSIONS` do not override this enforcement [source](https://github.com/apache/superset/issues/35182). The whitelist is hardcoded in the frontend and can only be changed by modifying the source code and rebuilding, which is not recommended due to security risks and project policy [source](https://github.com/apache/superset/issues/33865). This secure-by-default approach is required by Apache Foundation guidelines and recent updates have made sanitization even stricter [source](https://github.com/apache/superset/pull/36513). There are no current plans or features to make this user-configurable, but your use case (trusted intranet, need for custom tags) is valid and has come up in community discussions. If you want to propose a feature, it helps to describe your environment, why you need specific tags, and how you’d mitigate risks if sanitization were relaxed. For now, the only workaround is to use tags and attributes allowed by the sanitizer (e.g., `<span style="font-weight:bold">`), but even these may not work in all contexts due to frontend restrictions. Markdown components in dashboards may offer more flexibility, but table/chart cells remain strictly sanitized. Let me know if you want details on how to safely modify the frontend whitelist or draft a feature proposal for more flexible sanitization. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=reply-with-mention&utm_term=apache%2Fsuperset).* --- Share context across your team and agents. Try [Dosu](https://dosu.dev?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-tagline&utm_term=apache%2Fsuperset). [](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-feedback&utm_term=apache%2Fsuperset&message_id=c81283ce-080f-4155-9e92-b3248b02b9f8) [](https://github.dosu.com/apache/superset?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-learn-repo&utm_term=apache%2Fsuperset) [](https://app.dosu.dev/signup?referrer=openSource&source=github-footer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-add-team&utm_term=apache%2Fsuperset) GitHub link: https://github.com/apache/superset/discussions/36799#discussioncomment-15327330 ---- This is an automatically sent email for notifications@superset.apache.org. To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org --------------------------------------------------------------------- To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org For additional commands, e-mail: notifications-help@superset.apache.org Re: [D] Superset V6.0 - Table chart now longer shows bold text with HTML tag in columns [superset] Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.GitHub user dosubot[bot] added a comment to the discussion: Superset V6.0 - Table chart now longer shows bold text with HTML <b> tag in columns <!-- Answer --> For Superset, describing how you would mitigate risks if sanitization were relaxed is important—especially for security-related features—because the project follows a security-first approach aligned with Apache Foundation guidelines. Even if a feature is opt-in, maintainers want to understand the risks and how users would be protected if the feature is enabled, since any change could impact the broader community and future maintainers. Including your risk mitigation plan in a feature suggestion increases the chance it will be considered seriously. To safely modify the frontend whitelist and allow tags like `<b>` or `<li>`, edit `superset-frontend/packages/superset-ui-core/src/utils/html.tsx`. In the `whiteList` object, add your desired tags and allowed attributes, for example: ```js b: [], li: ['class', 'style'], ``` After editing, rebuild the frontend: ```bash cd superset-frontend npm run plugins:build npm run build-dev ``` Clear your browser cache and reload Superset to see the changes. Note: this change affects all users and increases XSS risk, so only do this in trusted environments and test thoroughly. [Reference](https://github.com/apache/superset/issues/34191) For a feature suggestion, explain your use case (e.g., trusted intranet, pre-tagged data), why current options are insufficient, and how you would mitigate risks (e.g., restrict to admin users, add warnings, document the risks). Here’s a template you can adapt: ``` **Title:** Make HTML sanitization whitelist user-configurable (opt-in) **Problem:** Superset’s strict frontend HTML sanitization prevents rendering of safe tags like `<b>` and `<li>`, even in trusted environments. This blocks important formatting for pre-tagged data. **Proposed Solution:** Add a user-configurable option (e.g., in superset_config.py or UI) to extend or override the frontend sanitizer whitelist, with clear warnings and opt-in gating. **Risk Mitigation:** - Restrict to admin users or trusted deployments - Add prominent warnings in the UI/config - Document XSS risks and best practices **Use Case:** We run Superset on a secured intranet with trusted data sources and need to render existing HTML formatting in tables/charts. **Alternatives tried:** Backend config, data preprocessing, and Markdown components—all insufficient for our needs. ``` Let me know if you want more details on any step or best practices for testing these changes. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- ^{How did I do? [Good](https://app.dosu.dev/response-feedback/cf1e0208-3275-4a9f-a234-b2139bbc7c84?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/cf1e0208-3275-4a9f-a234-b2139bbc7c84?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/cf1e0208-3275-4a9f-a234-b2139bbc7c84?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/cf1e0208-3275-4a9f-a234-b2139bbc7c84?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/cf1e0208-3275-4a9f-a234-b2139bbc7c84?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/cf1e0208-3275-4a9f-a234-b2139bbc7c84?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/cf1e0208-3275-4a9f-a234-b2139bbc7c84?feedback_type=other)} [](https://app.dosu.dev/a28d3c7e-a9d3-459e-9fb6-3a6f9ff4f357/ask?utm_source=github)&nbsp;[](https://cursor.com/link/prompt?text=For%20Superset%2C%20describing%20how%20you%20would%20mitigate%20risks%20if%20sanitization%20were%20relaxed%20is%20important%E2%80%94especially%20for%20security-related%20features%E2%80%94because%20the%20project%20follows%20a%20security-first%20approach%20aligned%20with%20Apache%20Foundation%20guidelines.%20Even%20if%20a%20feature%20is%20opt-in%2C%20maintainers%20want%20to%20understand%20the%20risks%20and%20how%20users%20would%20be%20protected%20if%20the%20feature%20is%20enabled%2C%20since%20any%20change%20could%20impact%20the%20broader%20community%20and%20future%20maintainers.%20Including%20your%20risk%20mitigation%20plan%20in%20a%20feature%20suggestion%20increases%20the%20chance%20it%20will%20be%20considered%20seriously.%0A%0ATo%20safely%20modify%20t he%20frontend%20whitelist%20and%20allow%20tags%20like%20%60%3Cb%3E%60%20or%20%60%3Cli%3E%60%2C%20edit%20%60superset-frontend/packages/superset-ui-core/src/utils/html.tsx%60.%20In%20the%20%60whiteList%60%20object%2C%20add%20your%20desired%20tags%20and%20allowed%20attributes%2C%20for%20example%3A%0A%60%60%60js%0Ab%3A%20%5B%5D%2C%0Ali%3A%20%5B%27class%27%2C%20%27style%27%5D%2C%0A%60%60%60%0AAfter%20editing%2C%20rebuild%20the%20frontend%3A%0A%60%60%60bash%0Acd%20superset-frontend%0Anpm%20run%20plugins%3Abuild%0Anpm%20run%20build-dev%0A%60%60%60%0AClear%20your%20browser%20cache%20and%20reload%20Superset%20to%20see%20the%20changes.%20Note%3A%20this%20change%20affects%20all%20users%20and%20increases%20XSS%20risk%2C%20so%20only%20do%20this%20in%20trusted%20environments%20and%20test%20thoroughly.%20%5BReference%5D%28https%3A//github.com/apache/superset/issues/34191%29%0A%0AFor%20a%20feature%20suggestion%2C%20explain%20your%20use%20case%20%28e.g.%2C%20trusted%20intranet%2C%20pre-tagged%20data %29%2C%20why%20current%20options%20are%20insufficient%2C%20and%20how%20you%20would%20mitigate%20risks%20%28e.g.%2C%20restrict%20to%20admin%20users%2C%20add%20warnings%2C%20document%20the%20risks%29.%20Here%E2%80%99s%20a%20template%20you%20can%20adapt%3A%0A%0A%60%60%60%0A%2A%2ATitle%3A%2A%2A%20Make%20HTML%20sanitization%20whitelist%20user-configurable%20%28opt-in%29%0A%0A%2A%2AProblem%3A%2A%2A%20%20%0ASuperset%E2%80%99s%20strict%20frontend%20HTML%20sanitization%20prevents%20rendering%20of%20safe%20tags%20like%20%60%3Cb%3E%60%20and%20%60%3Cli%3E%60%2C%20even%20in%20trusted%20environments.%20This%20blocks%20important%20formatting%20for%20pre-tagged%20data.%0A%0A%2A%2AProposed%20Solution%3A%2A%2A%20%20%0AAdd%20a%20user-configurable%20option%20%28e.g.%2C%20in%20superset_config.py%20or%20UI%29%20to%20extend%20or%20override%20the%20frontend%20sanitizer%20whitelist%2C%20with%20clear%20warnings%20and%20opt-in%20gating.%0A%0A%2A%2ARisk%20Mitigation%3A%2A%2A%20%20%0A-%20Restrict%20to%20admin%2 0users%20or%20trusted%20deployments%0A-%20Add%20prominent%20warnings%20in%20the%20UI/config%0A-%20Document%20XSS%20risks%20and%20best%20practices%0A%0A%2A%2AUse%20Case%3A%2A%2A%20%20%0AWe%20run%20Superset%20on%20a%20secured%20intranet%20with%20trusted%20data%20sources%20and%20need%20to%20render%20existing%20HTML%20formatting%20in%20tables/charts.%0A%0A%2A%2AAlternatives%20tried%3A%2A%2A%20%20%0ABackend%20config%2C%20data%20preprocessing%2C%20and%20Markdown%20components%E2%80%94all%20insufficient%20for%20our%20needs.%0A%60%60%60%0A%0ALet%20me%20know%20if%20you%20want%20more%20details%20on%20any%20step%20or%20best%20practices%20for%20testing%20these%20changes.)&nbsp;[](https://go.dosu.dev/discord-bot)&nbsp;[](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/di scussions/36799) GitHub link: https://github.com/apache/superset/discussions/36799#discussioncomment-15327580 ---- This is an automatically sent email for notifications@superset.apache.org. To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org --------------------------------------------------------------------- To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org For additional commands, e-mail: notifications-help@superset.apache.org Re: [D] Superset V6.0 - Table chart now longer shows bold text with HTML tag in columns [superset] Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.GitHub user dosubot[bot] added a comment to the discussion: Superset V6.0 - Table chart now longer shows bold text with HTML <b> tag in columns <!-- Answer --> In Superset 6.0, even if you set `HTML_SANITIZATION = False` and extend `HTML_SANITIZATION_SCHEMA_EXTENSIONS`, table/chart cells are still sanitized in the frontend using libraries like DOMPurify and rehype-sanitize. This stricter frontend sanitization cannot be bypassed by backend config changes, so tags like `<b>` are escaped and not rendered as HTML for security reasons. There is currently no supported way to render raw HTML (like `<b>`) in table/chart cells due to these enforced security measures ([source](https://github.com/apache/superset/issues/35182), [source](https://github.com/apache/superset/issues/36779), [source](https://github.com/apache/superset/pull/36513)). If you need to render HTML, dashboard Markdown components may respect your config overrides, but table/chart cells do not. This is an intentional change to prevent XSS vulnerabilities. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- ^{How did I do? [Good](https://app.dosu.dev/response-feedback/aff734cf-f483-4d5c-bcca-c7ed970f3a7a?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/aff734cf-f483-4d5c-bcca-c7ed970f3a7a?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/aff734cf-f483-4d5c-bcca-c7ed970f3a7a?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/aff734cf-f483-4d5c-bcca-c7ed970f3a7a?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/aff734cf-f483-4d5c-bcca-c7ed970f3a7a?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/aff734cf-f483-4d5c-bcca-c7ed970f3a7a?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/aff734cf-f483-4d5c-bcca-c7ed970f3a7a?feedback_type=other)} [](https://app.dosu.dev/a28d3c7e-a9d3-459e-9fb6-3a6f9ff4f357/ask?utm_source=github)&nbsp;[](https://cursor.com/link/prompt?text=In%20Superset%206.0%2C%20even%20if%20you%20set%20%60HTML_SANITIZATION%20%3D%20False%60%20and%20extend%20%60HTML_SANITIZATION_SCHEMA_EXTENSIONS%60%2C%20table/chart%20cells%20are%20still%20sanitized%20in%20the%20frontend%20using%20libraries%20like%20DOMPurify%20and%20rehype-sanitize.%20This%20stricter%20frontend%20sanitization%20cannot%20be%20bypassed%20by%20backend%20config%20changes%2C%20so%20tags%20like%20%60%3Cb%3E%60%20are%20escaped%20and%20not%20rendered%20as%20HTML%20for%20security%20reasons.%20There%20is%20currently%20no%20supported%20way%20to%20render%20raw%20HTML%20%28like%20%60%3Cb%3E%60%29%20in%20table/chart%20cells%20due%20to%20these%20enforced%20security%20measures%C2%A0%28%5Bsource%5D%28https%3A//github.com/apache/superset/issues/35182%29 %2C%20%5Bsource%5D%28https%3A//github.com/apache/superset/issues/36779%29%2C%20%5Bsource%5D%28https%3A//github.com/apache/superset/pull/36513%29%29.%20%0A%0AIf%20you%20need%20to%20render%20HTML%2C%20dashboard%20Markdown%20components%20may%20respect%20your%20config%20overrides%2C%20but%20table/chart%20cells%20do%20not.%20This%20is%20an%20intentional%20change%20to%20prevent%20XSS%20vulnerabilities.)&nbsp;[](https://go.dosu.dev/discord-bot)&nbsp;[](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/discussions/36799) GitHub link: https://github.com/apache/superset/discussions/36799#discussioncomment-15322528 ---- This is an automatically sent email for notifications@superset.apache.org. To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org --------------------------------------------------------------------- To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org For additional commands, e-mail: notifications-help@superset.apache.org Re: [D] Superset V6.0 - Table chart now longer shows bold text with HTML tag in columns [superset] Posted by "t-iva-nova (via GitHub)" <gi...@apache.org>.GitHub user t-iva-nova deleted a comment on the discussion: Superset V6.0 - Table chart now longer shows bold text with HTML <b> tag in columns I found solution via themes/ I created new one with this code (not sure this is absolutely correct code, but somehow this works :) : `{ "components": { "Typography": { "fontWeightStrong": 1000 } } }` GitHub link: https://github.com/apache/superset/discussions/36799#discussioncomment-17167853 ---- This is an automatically sent email for notifications@superset.apache.org. To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org --------------------------------------------------------------------- To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org For additional commands, e-mail: notifications-help@superset.apache.org Re: [D] Superset V6.0 - Table chart now longer shows bold text with HTML tag in columns [superset] Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.GitHub user dosubot[bot] added a comment to the discussion: Superset V6.0 - Table chart now longer shows bold text with HTML <b> tag in columns <!-- Answer --> There isn’t a supported way to turn off HTML sanitization in Superset 6.0 table/chart cells. Even with “Render columns in HTML format” enabled, only tags on the sanitizer’s whitelist (like `<span>`, `<img>`, `<a>`, etc.) will be rendered—`<b>` is not included, so it gets stripped or escaped for security reasons [reference](https://github.com/apache/superset/blob/master/superset-frontend/packages/superset-ui-core/src/utils/html.tsx). If you need bold formatting, you can update your database text to use `<span style="font-weight:bold">` instead of `<b>`, since `<span>` with inline styles is allowed and will render as bold in the table [reference](https://github.com/apache/superset/discussions/35000#discussioncomment-14325257). Disabling or bypassing this sanitization would require modifying the frontend source code and rebuilding, which is not recommended due to significant security risks [reference](https://github.com/apache/superset/issues/35182). If you want help with safe formatting options, let me know! <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- ^{How did I do? [Good](https://app.dosu.dev/response-feedback/66a542cf-b8a2-4039-b216-a99f9853bf21?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/66a542cf-b8a2-4039-b216-a99f9853bf21?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/66a542cf-b8a2-4039-b216-a99f9853bf21?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/66a542cf-b8a2-4039-b216-a99f9853bf21?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/66a542cf-b8a2-4039-b216-a99f9853bf21?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/66a542cf-b8a2-4039-b216-a99f9853bf21?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/66a542cf-b8a2-4039-b216-a99f9853bf21?feedback_type=other)} [](https://app.dosu.dev/a28d3c7e-a9d3-459e-9fb6-3a6f9ff4f357/ask?utm_source=github)&nbsp;[](https://cursor.com/link/prompt?text=There%20isn%E2%80%99t%20a%20supported%20way%20to%20turn%20off%20HTML%20sanitization%20in%20Superset%206.0%20table/chart%20cells.%20Even%20with%20%E2%80%9CRender%20columns%20in%20HTML%20format%E2%80%9D%20enabled%2C%20only%20tags%20on%20the%20sanitizer%E2%80%99s%20whitelist%20%28like%20%60%3Cspan%3E%60%2C%20%60%3Cimg%3E%60%2C%20%60%3Ca%3E%60%2C%20etc.%29%20will%20be%20rendered%E2%80%94%60%3Cb%3E%60%20is%20not%20included%2C%20so%20it%20gets%20stripped%20or%20escaped%20for%20security%20reasons%C2%A0%5Breference%5D%28https%3A//github.com/apache/superset/blob/master/superset-frontend/packages/superset-ui-core/src/utils/html.tsx%29.%0A%0AIf%20you%20need%20bold%20formatting%2C%20you%20can%20update%20your%20database%20text%20to%20use%20%60%3Cspan%20style%3D%22 font-weight%3Abold%22%3E%60%20instead%20of%20%60%3Cb%3E%60%2C%20since%20%60%3Cspan%3E%60%20with%20inline%20styles%20is%20allowed%20and%20will%20render%20as%20bold%20in%20the%20table%C2%A0%5Breference%5D%28https%3A//github.com/apache/superset/discussions/35000%23discussioncomment-14325257%29.%0A%0ADisabling%20or%20bypassing%20this%20sanitization%20would%20require%20modifying%20the%20frontend%20source%20code%20and%20rebuilding%2C%20which%20is%20not%20recommended%20due%20to%20significant%20security%20risks%C2%A0%5Breference%5D%28https%3A//github.com/apache/superset/issues/35182%29.%20If%20you%20want%20help%20with%20safe%20formatting%20options%2C%20let%20me%20know%21)&nbsp;[](https://go.dosu.dev/discord-bot)&nbsp;[](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/supers et/discussions/36799) GitHub link: https://github.com/apache/superset/discussions/36799#discussioncomment-15326647 ---- This is an automatically sent email for notifications@superset.apache.org. To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org --------------------------------------------------------------------- To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org For additional commands, e-mail: notifications-help@superset.apache.org Re: [D] Superset V6.0 - Table chart now longer shows bold text with HTML tag in columns [superset] Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.GitHub user dosubot[bot] edited a comment on the discussion: Superset V6.0 - Table chart now longer shows bold text with HTML <b> tag in columns <!-- Answer --> There isn’t a supported way to turn off HTML sanitization in Superset 6.0 table/chart cells. Even with “Render columns in HTML format” enabled, only tags on the sanitizer’s whitelist (like `<span>`, `<img>`, `<a>`, etc.) will be rendered—`<b>` is not included, so it gets stripped or escaped for security reasons [reference](https://github.com/apache/superset/blob/master/superset-frontend/packages/superset-ui-core/src/utils/html.tsx). If you need bold formatting, you can update your database text to use `<span style="font-weight:bold">` instead of `<b>`, since `<span>` with inline styles is allowed and will render as bold in the table [reference](https://github.com/apache/superset/discussions/35000#discussioncomment-14325257). Disabling or bypassing this sanitization would require modifying the frontend source code and rebuilding, which is not recommended due to significant security risks [reference](https://github.com/apache/superset/issues/35182). If you want help with safe formatting options, let me know! <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=reply-with-mention&utm_term=apache%2Fsuperset).* --- Docs are dead. Just use [Dosu](https://dosu.dev?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-tagline&utm_term=apache%2Fsuperset). [](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-feedback&utm_term=apache%2Fsuperset&message_id=66a542cf-b8a2-4039-b216-a99f9853bf21) [](https://github.dosu.com/apache/superset?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-ask-repo&utm_term=apache%2Fsuperset) [](https://app.dosu.dev/signup?referrer=openSource&source=github-footer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-share-team&utm_term=apache%2Fsuperset) GitHub link: https://github.com/apache/superset/discussions/36799#discussioncomment-15326647 ---- This is an automatically sent email for notifications@superset.apache.org. To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org --------------------------------------------------------------------- To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org For additional commands, e-mail: notifications-help@superset.apache.org Re: [D] Superset V6.0 - Table chart now longer shows bold text with HTML tag in columns [superset] Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.GitHub user dosubot[bot] edited a comment on the discussion: Superset V6.0 - Table chart now longer shows bold text with HTML <b> tag in columns <!-- Answer --> In Superset 6.0, even if you set `HTML_SANITIZATION = False` and extend `HTML_SANITIZATION_SCHEMA_EXTENSIONS`, table/chart cells are still sanitized in the frontend using libraries like DOMPurify and rehype-sanitize. This stricter frontend sanitization cannot be bypassed by backend config changes, so tags like `<b>` are escaped and not rendered as HTML for security reasons. There is currently no supported way to render raw HTML (like `<b>`) in table/chart cells due to these enforced security measures ([source](https://github.com/apache/superset/issues/35182), [source](https://github.com/apache/superset/issues/36779), [source](https://github.com/apache/superset/pull/36513)). If you need to render HTML, dashboard Markdown components may respect your config overrides, but table/chart cells do not. This is an intentional change to prevent XSS vulnerabilities. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=reply-with-mention&utm_term=apache%2Fsuperset).* --- Share context across your team and agents. Try [Dosu](https://dosu.dev?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-tagline&utm_term=apache%2Fsuperset). [](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-feedback&utm_term=apache%2Fsuperset&message_id=aff734cf-f483-4d5c-bcca-c7ed970f3a7a) [](https://github.dosu.com/apache/superset?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-learn-repo&utm_term=apache%2Fsuperset) [](https://app.dosu.dev/signup?referrer=openSource&source=github-footer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-add-team&utm_term=apache%2Fsuperset) GitHub link: https://github.com/apache/superset/discussions/36799#discussioncomment-15322528 ---- This is an automatically sent email for notifications@superset.apache.org. To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org --------------------------------------------------------------------- To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org For additional commands, e-mail: notifications-help@superset.apache.org Re: [D] Superset V6.0 - Table chart now longer shows bold text with HTML tag in columns [superset] Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.GitHub user dosubot[bot] added a comment to the discussion: Superset V6.0 - Table chart now longer shows bold text with HTML <b> tag in columns <!-- Answer --> This change is due to stricter HTML sanitization introduced in Superset 5.0 and continued in 6.0 to improve security and prevent XSS vulnerabilities. As a result, HTML tags like <b> are now escaped and displayed as plain text rather than rendered as HTML, even if "Render columns in HTML format" is enabled. This is an intentional security feature, not a bug. If you need to allow specific HTML tags (like <b>), you can configure the HTML_SANITIZATION_SCHEMA_EXTENSIONS setting in your Superset config to permit them, but be aware of the security implications before doing so. More details are discussed in [this issue](https://github.com/apache/superset/issues/35182). <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- ^{How did I do? [Good](https://app.dosu.dev/response-feedback/f200cee8-6062-45b7-9556-158344940291?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/f200cee8-6062-45b7-9556-158344940291?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/f200cee8-6062-45b7-9556-158344940291?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/f200cee8-6062-45b7-9556-158344940291?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/f200cee8-6062-45b7-9556-158344940291?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/f200cee8-6062-45b7-9556-158344940291?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/f200cee8-6062-45b7-9556-158344940291?feedback_type=other)} [](https://app.dosu.dev/a28d3c7e-a9d3-459e-9fb6-3a6f9ff4f357/ask?utm_source=github)&nbsp;[](https://cursor.com/link/prompt?text=This%20change%20is%20due%20to%20stricter%20HTML%20sanitization%20introduced%20in%20Superset%205.0%20and%20continued%20in%206.0%20to%20improve%20security%20and%20prevent%20XSS%20vulnerabilities.%20As%20a%20result%2C%20HTML%20tags%20like%20%3Cb%3E%20are%20now%20escaped%20and%20displayed%20as%20plain%20text%20rather%20than%20rendered%20as%20HTML%2C%20even%20if%20%22Render%20columns%20in%20HTML%20format%22%20is%20enabled.%20This%20is%20an%20intentional%20security%20feature%2C%20not%20a%20bug.%20If%20you%20need%20to%20allow%20specific%20HTML%20tags%20%28like%20%3Cb%3E%29%2C%20you%20can%20configure%20the%20HTML_SANITIZATION_SCHEMA_EXTENSIONS%20setting%20in%20your%20Superset%20config%20to%20permit%20them%2C%20but%20be%20aware%20of%20the%20security%20implicat ions%20before%20doing%20so.%20More%20details%20are%20discussed%20in%20%5Bthis%20issue%5D%28https%3A//github.com/apache/superset/issues/35182%29.)&nbsp;[](https://go.dosu.dev/discord-bot)&nbsp;[](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/discussions/36799) GitHub link: https://github.com/apache/superset/discussions/36799#discussioncomment-15321695 ---- This is an automatically sent email for notifications@superset.apache.org. To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org --------------------------------------------------------------------- To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org For additional commands, e-mail: notifications-help@superset.apache.org Re: [D] Superset V6.0 - Table chart now longer shows bold text with HTML tag in columns [superset] Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.GitHub user dosubot[bot] added a comment to the discussion: Superset V6.0 - Table chart now longer shows bold text with HTML <b> tag in columns <!-- Answer --> Strict HTML sanitization in Superset is enforced to prevent XSS vulnerabilities, even for tags like `<b>` and `<li>`, because any HTML tag—if not properly sanitized—can be abused for script injection or layout manipulation, especially in environments where user input is not fully controlled. This is why Superset’s frontend only allows a limited set of tags (like `<span>`, `<img>`, `<a>`, table elements) and excludes others, regardless of backend config or intranet deployment [source](https://github.com/apache/superset/issues/36779). Currently, there’s no supported way to disable or fully customize frontend sanitization for table/chart cells; backend settings like `HTML_SANITIZATION_SCHEMA_EXTENSIONS` do not override this enforcement [source](https://github.com/apache/superset/issues/35182). The whitelist is hardcoded in the frontend and can only be changed by modifying the source code and rebuilding, which is not recommended due to security risks and project policy [source](https://github.com/apache/superset/issues/33865). This secure-by-default approach is required by Apache Foundation guidelines and recent updates have made sanitization even stricter [source](https://github.com/apache/superset/pull/36513). There are no current plans or features to make this user-configurable, but your use case (trusted intranet, need for custom tags) is valid and has come up in community discussions. If you want to propose a feature, it helps to describe your environment, why you need specific tags, and how you’d mitigate risks if sanitization were relaxed. For now, the only workaround is to use tags and attributes allowed by the sanitizer (e.g., `<span style="font-weight:bold">`), but even these may not work in all contexts due to frontend restrictions. Markdown components in dashboards may offer more flexibility, but table/chart cells remain strictly sanitized. Let me know if you want details on how to safely modify the frontend whitelist or draft a feature proposal for more flexible sanitization. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- ^{How did I do? [Good](https://app.dosu.dev/response-feedback/c81283ce-080f-4155-9e92-b3248b02b9f8?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/c81283ce-080f-4155-9e92-b3248b02b9f8?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/c81283ce-080f-4155-9e92-b3248b02b9f8?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/c81283ce-080f-4155-9e92-b3248b02b9f8?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/c81283ce-080f-4155-9e92-b3248b02b9f8?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/c81283ce-080f-4155-9e92-b3248b02b9f8?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/c81283ce-080f-4155-9e92-b3248b02b9f8?feedback_type=other)} [](https://app.dosu.dev/a28d3c7e-a9d3-459e-9fb6-3a6f9ff4f357/ask?utm_source=github)&nbsp;[](https://cursor.com/link/prompt?text=Strict%20HTML%20sanitization%20in%20Superset%20is%20enforced%20to%20prevent%20XSS%20vulnerabilities%2C%20even%20for%20tags%20like%20%60%3Cb%3E%60%20and%20%60%3Cli%3E%60%2C%20because%20any%20HTML%20tag%E2%80%94if%20not%20properly%20sanitized%E2%80%94can%20be%20abused%20for%20script%20injection%20or%20layout%20manipulation%2C%20especially%20in%20environments%20where%20user%20input%20is%20not%20fully%20controlled.%20This%20is%20why%20Superset%E2%80%99s%20frontend%20only%20allows%20a%20limited%20set%20of%20tags%20%28like%20%60%3Cspan%3E%60%2C%20%60%3Cimg%3E%60%2C%20%60%3Ca%3E%60%2C%20table%20elements%29%20and%20excludes%20others%2C%20regardless%20of%20backend%20config%20or%20intranet%20deployment%20%5Bsource%5D%28https%3A//github.com/apache/superset/issue s/36779%29.%0A%0ACurrently%2C%20there%E2%80%99s%20no%20supported%20way%20to%20disable%20or%20fully%20customize%20frontend%20sanitization%20for%20table/chart%20cells%3B%20backend%20settings%20like%20%60HTML_SANITIZATION_SCHEMA_EXTENSIONS%60%20do%20not%20override%20this%20enforcement%20%5Bsource%5D%28https%3A//github.com/apache/superset/issues/35182%29.%20The%20whitelist%20is%20hardcoded%20in%20the%20frontend%20and%20can%20only%20be%20changed%20by%20modifying%20the%20source%20code%20and%20rebuilding%2C%20which%20is%20not%20recommended%20due%20to%20security%20risks%20and%20project%20policy%20%5Bsource%5D%28https%3A//github.com/apache/superset/issues/33865%29.%0A%0AThis%20secure-by-default%20approach%20is%20required%20by%20Apache%20Foundation%20guidelines%20and%20recent%20updates%20have%20made%20sanitization%20even%20stricter%20%5Bsource%5D%28https%3A//github.com/apache/superset/pull/36513%29.%20There%20are%20no%20current%20plans%20or%20features%20to%20make%20this%20user-configurable%2C %20but%20your%20use%20case%20%28trusted%20intranet%2C%20need%20for%20custom%20tags%29%20is%20valid%20and%20has%20come%20up%20in%20community%20discussions.%20If%20you%20want%20to%20propose%20a%20feature%2C%20it%20helps%20to%20describe%20your%20environment%2C%20why%20you%20need%20specific%20tags%2C%20and%20how%20you%E2%80%99d%20mitigate%20risks%20if%20sanitization%20were%20relaxed.%0A%0AFor%20now%2C%20the%20only%20workaround%20is%20to%20use%20tags%20and%20attributes%20allowed%20by%20the%20sanitizer%20%28e.g.%2C%20%60%3Cspan%20style%3D%22font-weight%3Abold%22%3E%60%29%2C%20but%20even%20these%20may%20not%20work%20in%20all%20contexts%20due%20to%20frontend%20restrictions.%20Markdown%20components%20in%20dashboards%20may%20offer%20more%20flexibility%2C%20but%20table/chart%20cells%20remain%20strictly%20sanitized.%0A%0ALet%20me%20know%20if%20you%20want%20details%20on%20how%20to%20safely%20modify%20the%20frontend%20whitelist%20or%20draft%20a%20feature%20proposal%20for%20more%20flexible%20sanit ization.)&nbsp;[](https://go.dosu.dev/discord-bot)&nbsp;[](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/discussions/36799) GitHub link: https://github.com/apache/superset/discussions/36799#discussioncomment-15327330 ---- This is an automatically sent email for notifications@superset.apache.org. To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org --------------------------------------------------------------------- To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org For additional commands, e-mail: notifications-help@superset.apache.org Re: [D] Superset V6.0 - Table chart now longer shows bold text with HTML tag in columns [superset] Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.GitHub user dosubot[bot] edited a comment on the discussion: Superset V6.0 - Table chart now longer shows bold text with HTML <b> tag in columns <!-- Answer --> For Superset, describing how you would mitigate risks if sanitization were relaxed is important—especially for security-related features—because the project follows a security-first approach aligned with Apache Foundation guidelines. Even if a feature is opt-in, maintainers want to understand the risks and how users would be protected if the feature is enabled, since any change could impact the broader community and future maintainers. Including your risk mitigation plan in a feature suggestion increases the chance it will be considered seriously. To safely modify the frontend whitelist and allow tags like `<b>` or `<li>`, edit `superset-frontend/packages/superset-ui-core/src/utils/html.tsx`. In the `whiteList` object, add your desired tags and allowed attributes, for example: ```js b: [], li: ['class', 'style'], ``` After editing, rebuild the frontend: ```bash cd superset-frontend npm run plugins:build npm run build-dev ``` Clear your browser cache and reload Superset to see the changes. Note: this change affects all users and increases XSS risk, so only do this in trusted environments and test thoroughly. [Reference](https://github.com/apache/superset/issues/34191) For a feature suggestion, explain your use case (e.g., trusted intranet, pre-tagged data), why current options are insufficient, and how you would mitigate risks (e.g., restrict to admin users, add warnings, document the risks). Here’s a template you can adapt: ``` **Title:** Make HTML sanitization whitelist user-configurable (opt-in) **Problem:** Superset’s strict frontend HTML sanitization prevents rendering of safe tags like `<b>` and `<li>`, even in trusted environments. This blocks important formatting for pre-tagged data. **Proposed Solution:** Add a user-configurable option (e.g., in superset_config.py or UI) to extend or override the frontend sanitizer whitelist, with clear warnings and opt-in gating. **Risk Mitigation:** - Restrict to admin users or trusted deployments - Add prominent warnings in the UI/config - Document XSS risks and best practices **Use Case:** We run Superset on a secured intranet with trusted data sources and need to render existing HTML formatting in tables/charts. **Alternatives tried:** Backend config, data preprocessing, and Markdown components—all insufficient for our needs. ``` Let me know if you want more details on any step or best practices for testing these changes. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=reply-with-mention&utm_term=apache%2Fsuperset).* --- Share context across your team and agents. Try [Dosu](https://dosu.dev?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-tagline&utm_term=apache%2Fsuperset). [](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-feedback&utm_term=apache%2Fsuperset&message_id=cf1e0208-3275-4a9f-a234-b2139bbc7c84) [](https://github.dosu.com/apache/superset?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-learn-repo&utm_term=apache%2Fsuperset) [](https://app.dosu.dev/signup?referrer=openSource&source=github-footer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-add-team&utm_term=apache%2Fsuperset) GitHub link: https://github.com/apache/superset/discussions/36799#discussioncomment-15327580 ---- This is an automatically sent email for notifications@superset.apache.org. To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org --------------------------------------------------------------------- To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org For additional commands, e-mail: notifications-help@superset.apache.org Re: [D] Superset V6.0 - Table chart now longer shows bold text with HTML tag in columns [superset] Posted by "Moosheimer (via GitHub)" <gi...@apache.org>.GitHub user Moosheimer edited a comment on the discussion: Superset V6.0 - Table chart now longer shows bold text with HTML <b> tag in columns @dosu Wow. That's tough. I read text from the database and display it in a table. The texts already have HTML tags such as &lt;b&gt;. This is extremely important because the text from the database is already tagged and should be displayed that way. Is there no way to turn that off? GitHub link: https://github.com/apache/superset/discussions/36799#discussioncomment-15322556 ---- This is an automatically sent email for notifications@superset.apache.org. To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org --------------------------------------------------------------------- To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org For additional commands, e-mail: notifications-help@superset.apache.org Re: [D] Superset V6.0 - Table chart now longer shows bold text with HTML tag in columns [superset] Posted by "Moosheimer (via GitHub)" <gi...@apache.org>.GitHub user Moosheimer added a comment to the discussion: Superset V6.0 - Table chart now longer shows bold text with HTML <b> tag in columns @dosu Is it important to describe how I would mitigate risks if sanitization were relaxed? If this is an opt-in, then it is the user's responsibility to do so. I don't think you should block something for the user on the assumption that they are not capable of deciding what the implications are. That's not the security-first approach. Security-first means that a system is secure. It doesn't mean that a user (a team, a company) can't opt in to bypass this if necessary. Yes, I would like details on how I can safely modify the frontend whitelist. At the same time, I would like to be able to create a feature suggestion for more flexible sanitization. GitHub link: https://github.com/apache/superset/discussions/36799#discussioncomment-15327532 ---- This is an automatically sent email for notifications@superset.apache.org. To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org --------------------------------------------------------------------- To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org For additional commands, e-mail: notifications-help@superset.apache.org Re: [D] Superset V6.0 - Table chart now longer shows bold text with HTML tag in columns [superset] Posted by "1cadumagalhaes (via GitHub)" <gi...@apache.org>.GitHub user 1cadumagalhaes added a comment to the discussion: Superset V6.0 - Table chart now longer shows bold text with HTML <b> tag in columns @dosu I am trying to display an image in a table, you said: > only tags on the sanitizer’s whitelist (like <span>, <img>, <a>, etc.) will be rendered I can render a link (<a> tag) but the image does not work at all. It displays as raw text. GitHub link: https://github.com/apache/superset/discussions/36799#discussioncomment-15437513 ---- This is an automatically sent email for notifications@superset.apache.org. To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org --------------------------------------------------------------------- To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org For additional commands, e-mail: notifications-help@superset.apache.org Re: [D] Superset V6.0 - Table chart now longer shows bold text with HTML tag in columns [superset] Posted by "Moosheimer (via GitHub)" <gi...@apache.org>.GitHub user Moosheimer added a comment to the discussion: Superset V6.0 - Table chart now longer shows bold text with HTML <b> tag in columns Wow. That's tough. I read text from the database and display it in a table. The texts already have HTML tags such as <b>. This is extremely important because the text from the database is already tagged and should be displayed that way. Is there no way to turn that off? GitHub link: https://github.com/apache/superset/discussions/36799#discussioncomment-15322556 ---- This is an automatically sent email for notifications@superset.apache.org. To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org --------------------------------------------------------------------- To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org For additional commands, e-mail: notifications-help@superset.apache.org Re: [D] Superset V6.0 - Table chart now longer shows bold text with HTML tag in columns [superset] Posted by "Moosheimer (via GitHub)" <gi...@apache.org>.GitHub user Moosheimer deleted a comment on the discussion: Superset V6.0 - Table chart now longer shows bold text with HTML <b> tag in columns @dosu Wow. That's tough. I read text from the database and display it in a table. The texts already have HTML tags such as &lt;b&gt;. This is extremely important because the text from the database is already tagged and should be displayed that way. Is there no way to turn that off? GitHub link: https://github.com/apache/superset/discussions/36799#discussioncomment-15322556 ---- This is an automatically sent email for notifications@superset.apache.org. To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org --------------------------------------------------------------------- To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org For additional commands, e-mail: notifications-help@superset.apache.org Re: [D] Superset V6.0 - Table chart now longer shows bold text with HTML tag in columns [superset] Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.GitHub user dosubot[bot] edited a comment on the discussion: Superset V6.0 - Table chart now longer shows bold text with HTML <b> tag in columns <!-- Answer --> This change is due to stricter HTML sanitization introduced in Superset 5.0 and continued in 6.0 to improve security and prevent XSS vulnerabilities. As a result, HTML tags like <b> are now escaped and displayed as plain text rather than rendered as HTML, even if "Render columns in HTML format" is enabled. This is an intentional security feature, not a bug. If you need to allow specific HTML tags (like <b>), you can configure the HTML_SANITIZATION_SCHEMA_EXTENSIONS setting in your Superset config to permit them, but be aware of the security implications before doing so. More details are discussed in [this issue](https://github.com/apache/superset/issues/35182). <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=reply-with-mention&utm_term=apache%2Fsuperset).* --- Docs are dead. Just use [Dosu](https://dosu.dev?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-tagline&utm_term=apache%2Fsuperset). [](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-feedback&utm_term=apache%2Fsuperset&message_id=f200cee8-6062-45b7-9556-158344940291) [](https://github.dosu.com/apache/superset?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-ask-repo&utm_term=apache%2Fsuperset) [](https://app.dosu.dev/signup?referrer=openSource&source=github-footer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-share-team&utm_term=apache%2Fsuperset) GitHub link: https://github.com/apache/superset/discussions/36799#discussioncomment-15321695 ---- This is an automatically sent email for notifications@superset.apache.org. To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org --------------------------------------------------------------------- To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org For additional commands, e-mail: notifications-help@superset.apache.org Re: [D] Superset V6.0 - Table chart now longer shows bold text with HTML tag in columns [superset] Posted by "Moosheimer (via GitHub)" <gi...@apache.org>.GitHub user Moosheimer added a comment to the discussion: Superset V6.0 - Table chart now longer shows bold text with HTML <b> tag in columns @dosu Replacing &lt;b&gt; with &lt;span style="font-weight:bold"&gt; doesn't always work. I have an example where it doesn't work - even though it works as a Postgres query, it doesn't work with Superset. But that's not even the problem. The real problem is that we use tables/chart extensively and would have to parse every single query and replace all &lt;b&gt; and &lt;li&gt;. And that for every query?! And then it doesn't work everywhere (see above). Are &lt;b&gt; and &lt;li&gt; really an XSS insecurity issue? I suggest planning an extension for the next release where you can either completely disable all SANITIZATION or at least whitelist the ones that are needed. Our application runs on the intranet and therefore does not need to be explicitly secured. I don't think we're the only ones encountering this problem (at least so far). Security is extremely important. But aren't we going too far with this strict regulation that can't be disabled? Can't we leave it up to the user to decide whether to disable this strict setting at all? Or at least give them the option to whitelist all desired tags across the board? GitHub link: https://github.com/apache/superset/discussions/36799#discussioncomment-15327320 ---- This is an automatically sent email for notifications@superset.apache.org. To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org --------------------------------------------------------------------- To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org For additional commands, e-mail: notifications-help@superset.apache.org Re: [D] Superset V6.0 - Table chart now longer shows bold text with HTML tag in columns [superset] Posted by "t-iva-nova (via GitHub)" <gi...@apache.org>.GitHub user t-iva-nova added a comment to the discussion: Superset V6.0 - Table chart now longer shows bold text with HTML <b> tag in columns I found solution via themes/ I created new one with this code (not sure this is absolutely correct code, but somehow this works :) : `{ "components": { "Typography": { "fontWeightStrong": 1000 } } }` GitHub link: https://github.com/apache/superset/discussions/36799#discussioncomment-17167853 ---- This is an automatically sent email for notifications@superset.apache.org. To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org --------------------------------------------------------------------- To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org For additional commands, e-mail: notifications-help@superset.apache.org Re: [D] Superset V6.0 - Table chart now longer shows bold text with HTML tag in columns [superset] Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.GitHub user dosubot[bot] edited a comment on the discussion: Superset V6.0 - Table chart now longer shows bold text with HTML <b> tag in columns <!-- Answer --> To suggest a new feature or enhancement for Superset, you have two main options: 1. For general feature ideas, use GitHub Discussions: go to the [Superset Discussions page](https://github.com/apache/superset/discussions), search to see if your idea already exists, and if not, create a new post under the "Ideas" category. This is the recommended place for most feature suggestions and for gathering community feedback before anything formal is proposed. [Reference](https://github.com/apache/superset/blob/master/.github/ISSUE_TEMPLATE/bug-report.yml) 2. For major changes or formal proposals, submit a Superset Improvement Proposal (SIP). To do this, draft your proposal using the [SIP template](https://github.com/apache/superset/blob/master/.github/ISSUE_TEMPLATE/sip.md) (sections include Motivation, Proposed Change, Risk Mitigation, etc.), then email a link to your proposal to dev@superset.apache.org. You can subscribe to the dev mailing list by sending a blank email to dev-subscribe@superset.apache.org. [Reference](https://github.com/apache/superset/issues/33012) About changing the frontend HTML sanitizer: there is no supported way to modify the whitelist or disable sanitization in a pip/Miniconda install without editing the frontend source code and rebuilding. There are no plugins or config options for this—frontend sanitization is hardcoded for security reasons. [Reference](https://github.com/apache/superset/issues/35182) If you can't make code changes yourself, you can still propose the feature as above, and mention your use case (trusted intranet, pre-tagged data, etc.) and why current options don't work for you. This helps the community understand the need and may attract collaborators. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=reply-with-mention&utm_term=apache%2Fsuperset).* --- Share context across your team and agents. Try [Dosu](https://dosu.dev?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-tagline&utm_term=apache%2Fsuperset). [](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-feedback&utm_term=apache%2Fsuperset&message_id=b4dae025-00c3-4ecb-95e4-2b208ecf0996) [](https://github.dosu.com/apache/superset?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-learn-repo&utm_term=apache%2Fsuperset) [](https://app.dosu.dev/signup?referrer=openSource&source=github-footer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-add-team&utm_term=apache%2Fsuperset) GitHub link: https://github.com/apache/superset/discussions/36799#discussioncomment-15328102 ---- This is an automatically sent email for notifications@superset.apache.org. To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org --------------------------------------------------------------------- To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org For additional commands, e-mail: notifications-help@superset.apache.org Re: [D] Superset V6.0 - Table chart now longer shows bold text with HTML tag in columns [superset] Posted by "Moosheimer (via GitHub)" <gi...@apache.org>.GitHub user Moosheimer added a comment to the discussion: Superset V6.0 - Table chart now longer shows bold text with HTML <b> tag in columns @dosu I changed superset_config.py as follows: HTML_SANITIZATION = False HTML_SANITIZATION_SCHEMA_EXTENSIONS = { "attributes": { "*": ["style", "className", "class", "src", "width", "height", "frameborder", "marginwidth", "marginheight", "scrolling", "target", "background-color"], }, "tagNames": ["style", "iframe", "h1", "h2", "h3", "h4", "h5", "h6", "b", "span"], } But <b> still isn't rendered. GitHub link: https://github.com/apache/superset/discussions/36799#discussioncomment-15322513 ---- This is an automatically sent email for notifications@superset.apache.org. To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org --------------------------------------------------------------------- To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org For additional commands, e-mail: notifications-help@superset.apache.org Re: [D] Superset V6.0 - Table chart now longer shows bold text with HTML tag in columns [superset] Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.GitHub user dosubot[bot] added a comment to the discussion: Superset V6.0 - Table chart now longer shows bold text with HTML <b> tag in columns <!-- Answer --> To suggest a new feature or enhancement for Superset, you have two main options: 1. For general feature ideas, use GitHub Discussions: go to the [Superset Discussions page](https://github.com/apache/superset/discussions), search to see if your idea already exists, and if not, create a new post under the "Ideas" category. This is the recommended place for most feature suggestions and for gathering community feedback before anything formal is proposed. [Reference](https://github.com/apache/superset/blob/master/.github/ISSUE_TEMPLATE/bug-report.yml) 2. For major changes or formal proposals, submit a Superset Improvement Proposal (SIP). To do this, draft your proposal using the [SIP template](https://github.com/apache/superset/blob/master/.github/ISSUE_TEMPLATE/sip.md) (sections include Motivation, Proposed Change, Risk Mitigation, etc.), then email a link to your proposal to dev@superset.apache.org. You can subscribe to the dev mailing list by sending a blank email to dev-subscribe@superset.apache.org. [Reference](https://github.com/apache/superset/issues/33012) About changing the frontend HTML sanitizer: there is no supported way to modify the whitelist or disable sanitization in a pip/Miniconda install without editing the frontend source code and rebuilding. There are no plugins or config options for this—frontend sanitization is hardcoded for security reasons. [Reference](https://github.com/apache/superset/issues/35182) If you can't make code changes yourself, you can still propose the feature as above, and mention your use case (trusted intranet, pre-tagged data, etc.) and why current options don't work for you. This helps the community understand the need and may attract collaborators. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- ^{How did I do? [Good](https://app.dosu.dev/response-feedback/b4dae025-00c3-4ecb-95e4-2b208ecf0996?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/b4dae025-00c3-4ecb-95e4-2b208ecf0996?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/b4dae025-00c3-4ecb-95e4-2b208ecf0996?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/b4dae025-00c3-4ecb-95e4-2b208ecf0996?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/b4dae025-00c3-4ecb-95e4-2b208ecf0996?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/b4dae025-00c3-4ecb-95e4-2b208ecf0996?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/b4dae025-00c3-4ecb-95e4-2b208ecf0996?feedback_type=other)} [](https://app.dosu.dev/a28d3c7e-a9d3-459e-9fb6-3a6f9ff4f357/ask?utm_source=github)&nbsp;[](https://cursor.com/link/prompt?text=To%20suggest%20a%20new%20feature%20or%20enhancement%20for%20Superset%2C%20you%20have%20two%20main%20options%3A%0A%0A1.%20For%20general%20feature%20ideas%2C%20use%20GitHub%20Discussions%3A%20go%20to%20the%20%5BSuperset%20Discussions%20page%5D%28https%3A//github.com/apache/superset/discussions%29%2C%20search%20to%20see%20if%20your%20idea%20already%20exists%2C%20and%20if%20not%2C%20create%20a%20new%20post%20under%20the%20%22Ideas%22%20category.%20This%20is%20the%20recommended%20place%20for%20most%20feature%20suggestions%20and%20for%20gathering%20community%20feedback%20before%20anything%20formal%20is%20proposed.%20%20%0A%20%20%20%5BReference%5D%28https%3A//github.com/apache/superset/blob/master/.github/ISSUE_TEMPLATE/bug-report.yml%29%0A%0A2.%20For%20majo r%20changes%20or%20formal%20proposals%2C%20submit%20a%20Superset%20Improvement%20Proposal%20%28SIP%29.%20To%20do%20this%2C%20draft%20your%20proposal%20using%20the%20%5BSIP%20template%5D%28https%3A//github.com/apache/superset/blob/master/.github/ISSUE_TEMPLATE/sip.md%29%20%28sections%20include%20Motivation%2C%20Proposed%20Change%2C%20Risk%20Mitigation%2C%20etc.%29%2C%20then%20email%20a%20link%20to%20your%20proposal%20to%20dev%40superset.apache.org.%20You%20can%20subscribe%20to%20the%20dev%20mailing%20list%20by%20sending%20a%20blank%20email%20to%20dev-subscribe%40superset.apache.org.%20%20%0A%20%20%20%5BReference%5D%28https%3A//github.com/apache/superset/issues/33012%29%0A%0AAbout%20changing%20the%20frontend%20HTML%20sanitizer%3A%20there%20is%20no%20supported%20way%20to%20modify%20the%20whitelist%20or%20disable%20sanitization%20in%20a%20pip/Miniconda%20install%20without%20editing%20the%20frontend%20source%20code%20and%20rebuilding.%20There%20are%20no%20plugins%20or%20config%20options% 20for%20this%E2%80%94frontend%20sanitization%20is%20hardcoded%20for%20security%20reasons.%20%20%0A%5BReference%5D%28https%3A//github.com/apache/superset/issues/35182%29%0A%0AIf%20you%20can%27t%20make%20code%20changes%20yourself%2C%20you%20can%20still%20propose%20the%20feature%20as%20above%2C%20and%20mention%20your%20use%20case%20%28trusted%20intranet%2C%20pre-tagged%20data%2C%20etc.%29%20and%20why%20current%20options%20don%27t%20work%20for%20you.%20This%20helps%20the%20community%20understand%20the%20need%20and%20may%20attract%20collaborators.)&nbsp;[](https://go.dosu.dev/discord-bot)&nbsp;[](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/discussions/36799) GitHub link: https://github.com/apache/superset/discussions/36799#discussioncomment-15328102 ---- This is an automatically sent email for notifications@superset.apache.org. To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org --------------------------------------------------------------------- To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org For additional commands, e-mail: notifications-help@superset.apache.org Re: [D] Superset V6.0 - Table chart now longer shows bold text with HTML tag in columns [superset] Posted by "Moosheimer (via GitHub)" <gi...@apache.org>.GitHub user Moosheimer edited a comment on the discussion: Superset V6.0 - Table chart now longer shows bold text with HTML <b> tag in columns Wow. That's tough. I read text from the database and display it in a table. The texts already have HTML tags such as <pre> <b></pre>. This is extremely important because the text from the database is already tagged and should be displayed that way. Is there no way to turn that off? GitHub link: https://github.com/apache/superset/discussions/36799#discussioncomment-15322556 ---- This is an automatically sent email for notifications@superset.apache.org. To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org --------------------------------------------------------------------- To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org For additional commands, e-mail: notifications-help@superset.apache.org]