You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@superset.apache.org by ru...@apache.org on 2026/06/03 09:33:29 UTC
(superset) branch fix/reject-default-secrets-on-startup updated (9fbd93ec3ef -> d9436df273b)
This is an automated email from the ASF dual-hosted git repository.
rusackas pushed a change to branch fix/reject-default-secrets-on-startup
in repository https://gitbox.apache.org/repos/asf/superset.git
discard 9fbd93ec3ef fix(security): reject default guest/async JWT secrets at startup
add 365914f1c76 chore(deps-dev): bump @typescript-eslint/eslint-plugin from 8.59.4 to 8.60.0 in /superset-websocket (#40595)
add c29591b3b1b chore(deps): update @babel/runtime requirement from ^7.29.2 to ^7.29.7 in /superset-frontend/packages/superset-ui-core (#40606)
add a6d2c954803 chore(deps): migrate MCP service JWT errors from authlib.jose to joserfc (#40582)
add 817a35f445d fix(mcp): deny deactivated user accounts in MCP authentication (#40631)
add c6faa50338b fix(cli): encrypt sqlalchemy_uri password on import_datasources (#31983) (#40584)
add 2abbb64e6bc feat(gsheets): restore public/private sheet selector (#40466)
add e2ed9896399 fix(reports): skip permalink when dashboard state has no anchor or filters (#40530)
add 052e567f775 fix: guard dynamic dispatch and bound a regex quantifier (#40547)
add ca8855dc037 fix(mcp): generic auth errors, required token expiry, and safer auth logging (#40646)
add aba6ea536cc fix(dashboard): prevent "undefined undefined" owner names in properties modal (#40528)
add ddb647cd3ae fix(dashboard): clear undo history (#40569)
add 88abd41c8b8 fix(sql-lab): prevent crash when host shell lacks useAppDispatch export (#40591)
add 7275116f4cd fix(world-map): preserve bubbles and exclude only null metrics from color scale (#39926)
add fc0245bdb06 fix(charts): show non-filterable columns in metric section for table … (#39524)
add 699e741c69d fix(time-comparison): shift offset filter when X-axis is adhoc Custom SQL (#40586)
add d26a7aac3dd fix(dashboard): hide Edit button in embedded dashboards (#40687)
add 4996d7c277f fix: avoid warning spam when default spinner SVG is missing (#40481)
add 093b43c7a58 fix(exports,email,logs): csv formula escaping, subject CRLF stripping, UTC log pruning (#40645)
add 1632b235ae8 fix(sqllab): surface stacktrace in SQL Lab error responses (#28248) (#40585)
add 24422c83114 test(histogram): metric filters require aggregation in buildQuery (#30330) (#40617)
add 242c27a9743 test(presto): 401 Unauthorized must surface as CONNECTION_ACCESS_DENIED_ERROR (#33554) (#40618)
add 1b8099811b8 fix(chart-list): sort by changed_on instead of last_saved_at (#39984)
add d2d46169bf6 fix(explore): tighten popover title-to-tabs spacing to 12px (#40410)
add 19c2b67d09a fix(websocket): validate last_id query param format (#40626)
add 86fa5bb46f0 feat(table v2): agGridTableChart add row numer column (#39284)
add 4d2b10d916e chore(excel): strip document metadata from Excel exports (#40661)
add b97d3ef520b fix(api,sql): use json_response in Api.query and log dialect fallback (#40644)
add 00dd31494d1 fix: sanitize URL sinks and trim sensitive log fields (#40546)
add 616c2432780 fix(deps): revert joserfc JWT error migration — fastmcp still uses authlib (#40688)
add 49f3dbba733 fix(dashboard): address post-approval review feedback on #40528 (#40685)
add 8508af3201c chore(key_value): prune expired entries from the key-value store (#40663)
add a9df2c7e5ea fix(mcp): address post-approval review feedback on auth logging PR #40646 (#40684)
add 3e589436fa6 fix(reports): sanitize error text in email notification template (#40641)
add 6eaee211aad fix(sqllab): require dataset match for raw query access (#40409)
add 17d1a45bc94 feat(ydb): switch to native YDB sqlglot dialect (#40170)
add 8c62f533d7c fix(core): restrict allowed CSS properties in sanitized HTML (#40627)
add 6abee0289b8 fix(reports): guard SUCCESS-state report execution against duplicate sends and stuck WORKING state (#40657)
add 9af6746dbe1 fix(models): HTML-escape data-controlled values in dashboard_link and Slice.icons (#40639)
add a2a369cb5c8 fix(charts): sanitize tooltip HTML across nvd3, rose and partition plugins (#40502)
add 3bbb35e8a33 ci(bashlib): drop the dead bc-based NONCE (perf + reliability) (#40691)
add c54990c861b fix(plugin-chart-ag-grid-table): validate filter values/operators in state converter (#40623)
add ac522ded1c4 fix(ssh-tunnel): validate server_address format (SSRF defense-in-depth) (#40665)
add 0b9764aed56 fix(mcp): honor AUTH_ROLE_ADMIN and warn on permission-less protected tools (#40659)
add 12bef03f4af fix(jinja): apply consistent escaping to url_param values from request args (#40633)
add df21fe65718 chore(mcp): return a generic error from the webdriver pool-stats endpoint (#40559)
add fa41769a08a fix(embedded): enforce configured allowed domains for postMessage origin (#40629)
add b9dc9d722e6 fix(export): sanitize user-supplied CSV export filename (charts + SQL Lab) (#40632)
add d9436df273b fix(security): reject default guest/async JWT secrets at startup
This update added new revisions after undoing existing revisions.
That is to say, some revisions that were in the old version of the
branch are not in the new version. This situation occurs
when a user --force pushes a change and generates a repository
containing something like this:
* -- * -- B -- O -- O -- O (9fbd93ec3ef)
\
N -- N -- N refs/heads/fix/reject-default-secrets-on-startup (d9436df273b)
You should already have received notification emails for all of the O
revisions, and so the following emails describe only the N revisions
from the common base, B.
Any revisions marked "omit" are not gone; other references still
refer to them. Any revisions marked "discard" are gone forever.
No new revisions were added by this update.
Summary of changes:
.github/workflows/bashlib.sh | 4 -
SECURITY.md | 2 +-
UPDATING.md | 10 +
pyproject.toml | 2 +-
superset-frontend/package-lock.json | 18 +-
superset-frontend/package.json | 1 +
.../superset-core/src/theme/GlobalStyles.tsx | 15 ++
.../src/operators/boxplotOperator.ts | 2 +-
.../packages/superset-ui-core/package.json | 3 +-
.../src/components/ListViewCard/index.tsx | 3 +-
.../src/connection/SupersetClientClass.ts | 3 +-
.../superset-ui-core/src/utils/html.test.tsx | 29 +++
.../packages/superset-ui-core/src/utils/html.tsx | 46 +++-
.../superset-ui-core/test/utils/tooltip.test.ts | 21 +-
.../legacy-plugin-chart-partition/src/Partition.ts | 3 +-
.../plugins/legacy-plugin-chart-rose/src/Rose.ts | 13 +-
.../legacy-plugin-chart-world-map/src/WorldMap.ts | 5 +-
.../test/WorldMap.test.ts | 57 ++++-
.../plugins/legacy-preset-chart-nvd3/src/utils.ts | 33 ++-
.../legacy-preset-chart-nvd3/test/utils.test.ts | 95 +++++++
.../src/AgGridTableChart.tsx | 4 +
.../plugin-chart-ag-grid-table/src/consts.ts | 2 +
.../src/controlPanel.tsx | 18 +-
.../src/stateConversion.ts | 30 ++-
.../src/styles/index.tsx | 6 +
.../src/transformProps.ts | 2 +
.../plugin-chart-ag-grid-table/src/types.ts | 2 +
.../src/utils/useColDefs.ts | 69 ++++-
.../test/controlPanel.test.tsx | 71 ++++++
.../test/stateConversion.test.ts | 73 ++++++
.../test/utils/useColDefs.test.ts | 240 ++++++++++++++++++
.../src/Histogram/buildQuery.ts | 15 +-
.../test/Histogram/buildQuery.test.ts | 81 ++++++
.../src/plugin/controls/columns.tsx | 8 +-
.../src/plugin/controls/metrics.tsx | 8 +-
.../plugin-chart-table/src/controlPanel.tsx | 6 +-
.../plugin-chart-table/test/controlPanel.test.tsx | 71 ++++++
.../src/SqlLab/components/EditorAutoSync/index.tsx | 2 +-
.../src/SqlLab/components/EditorWrapper/index.tsx | 2 +-
.../SqlLab/components/EditorWrapper/useKeywords.ts | 2 +-
.../components/ExploreCtasResultsButton/index.tsx | 2 +-
.../src/SqlLab/components/PopEditorTab/index.tsx | 2 +-
.../SqlLab/components/QueryAutoRefresh/index.tsx | 2 +-
.../SqlLab/components/QueryLimitSelect/index.tsx | 2 +-
.../src/SqlLab/components/QueryTable/index.tsx | 2 +-
.../src/SqlLab/components/ResultSet/index.tsx | 5 +-
.../SqlLab/components/SaveDatasetModal/index.tsx | 9 +-
.../src/SqlLab/components/SouthPane/index.tsx | 2 +-
.../src/SqlLab/components/SqlEditor/index.tsx | 2 +-
.../SqlLab/components/SqlEditorLeftBar/index.tsx | 2 +-
.../SqlLab/components/SqlEditorTabHeader/index.tsx | 2 +-
.../SqlEditorTopBar/useDatabaseSelector.ts | 2 +-
.../src/SqlLab/components/TableElement/index.tsx | 2 +-
.../SqlLab/components/TableExploreTree/index.tsx | 2 +-
.../components/TableExploreTree/useTreeData.ts | 2 +-
.../src/SqlLab/components/TablePreview/index.tsx | 2 +-
.../index.tsx => SqlLab/hooks/useAppDispatch.ts} | 23 +-
.../types.ts => SqlLab/hooks/useAppSelector.ts} | 10 +-
.../DatasourceEditor/DatasourceEditor.tsx | 3 +-
.../src/components/GenericLink/index.tsx | 4 +-
.../dashboard/components/Header/Header.test.tsx | 15 ++
.../src/dashboard/components/Header/index.tsx | 3 +-
.../dashboard/components/PropertiesModal/index.tsx | 20 +-
.../PropertiesModal/sections/AccessSection.tsx | 6 +-
.../components/PropertiesModal/utils.test.ts | 90 +++++++
.../dashboard/components/PropertiesModal/utils.ts | 81 ++++++
.../dashboard/containers/DashboardPage.test.tsx | 35 +++
.../src/dashboard/containers/DashboardPage.tsx | 2 +
superset-frontend/src/embedded/index.tsx | 30 +--
.../src/embedded/originValidation.test.ts | 112 ++++++++
superset-frontend/src/embedded/originValidation.ts | 91 +++++++
.../ExploreChartHeader/ExploreChartHeader.test.tsx | 53 ++--
.../controls/ControlPopover/ControlPopover.tsx | 1 +
.../DatabaseConnectionForm.test.tsx | 85 +++++++
.../DatabaseConnectionForm/EncryptedField.test.tsx | 148 ++++++++++-
.../DatabaseConnectionForm/EncryptedField.tsx | 68 ++++-
.../OAuth2ClientField.test.tsx | 82 ++++++
.../DatabaseConnectionForm/OAuth2ClientField.tsx | 78 ++++--
.../DatabaseConnectionForm/TableCatalog.test.tsx | 87 +++++++
.../DatabaseConnectionForm/TableCatalog.tsx | 18 +-
.../DatabaseModal/DatabaseConnectionForm/index.tsx | 112 +++++---
.../databases/DatabaseModal/SqlAlchemyForm.tsx | 5 +-
.../databases/DatabaseModal/index.test.tsx | 116 +++++++++
.../src/features/databases/DatabaseModal/index.tsx | 54 +++-
.../src/features/databases/DatabaseModal/styles.ts | 11 +-
superset-frontend/src/features/databases/types.ts | 4 +
superset-frontend/src/middleware/asyncEvent.ts | 7 +-
.../pages/ChartList/ChartList.listview.test.tsx | 5 +-
superset-frontend/src/pages/ChartList/index.tsx | 4 +-
superset-frontend/src/types/bootstrapTypes.ts | 3 +
superset-frontend/src/utils/getOwnerName.test.ts | 12 +
superset-frontend/src/utils/getOwnerName.ts | 5 +-
superset-frontend/src/utils/navigationUtils.ts | 11 +-
superset-websocket/package-lock.json | 4 +-
superset-websocket/package.json | 4 +-
superset-websocket/spec/index.test.ts | 54 ++++
superset-websocket/src/index.ts | 19 +-
superset/charts/data/api.py | 7 +
superset/commands/dataset/importers/v0.py | 18 +-
superset/commands/logs/prune.py | 5 +-
superset/commands/report/execute.py | 83 ++++--
superset/config.py | 7 +
superset/daos/key_value.py | 32 +++
superset/databases/schemas.py | 18 +-
superset/db_engine_specs/presto.py | 6 +
superset/db_engine_specs/ydb.py | 2 +-
superset/embedded/view.py | 4 +
superset/extensions/metadb.py | 11 +-
superset/jinja_context.py | 12 +-
.../key_value/commands}/__init__.py | 0
superset/key_value/commands/prune.py | 143 +++++++++++
superset/mcp_service/auth.py | 87 +++++--
superset/mcp_service/chart/validation/pipeline.py | 6 +-
superset/mcp_service/jwt_verifier.py | 61 ++++-
superset/mcp_service/middleware.py | 3 +-
.../mcp_service/screenshot/webdriver_config.py | 16 +-
superset/mcp_service/storage.py | 4 +-
superset/mcp_service/utils/error_sanitization.py | 44 +++-
superset/mcp_service/utils/permissions_utils.py | 19 +-
superset/models/dashboard.py | 5 +-
superset/models/helpers.py | 9 +-
superset/models/slice.py | 8 +-
superset/models/sql_lab.py | 10 +-
superset/reports/notifications/email.py | 8 +-
superset/security/manager.py | 128 ++++++++--
superset/sql/execution/celery_task.py | 6 +-
superset/sql/parse.py | 31 ++-
superset/sql_lab.py | 6 +-
superset/sqllab/api.py | 8 +
superset/sqllab/validators.py | 6 +-
superset/tasks/scheduler.py | 16 ++
.../templates/superset}/loading.svg | Bin
superset/utils/core.py | 3 +
superset/utils/csv.py | 7 +-
superset/utils/excel.py | 24 ++
superset/views/api.py | 2 +-
superset/views/base.py | 45 ++--
tests/integration_tests/embedded/test_view.py | 33 +++
.../commands/execute_dashboard_report_tests.py | 4 +-
tests/integration_tests/security_tests.py | 250 ++++++++++++++++++
tests/integration_tests/sqllab_tests.py | 34 +--
tests/unit_tests/charts/test_chart_data_api.py | 31 +++
.../unit_tests/commands/logs}/__init__.py | 0
tests/unit_tests/commands/logs/prune_test.py | 54 ++++
tests/unit_tests/commands/report/execute_test.py | 128 +++++++++-
.../common/test_query_context_processor.py | 95 +++++++
.../databases/commands/importers/v1/import_test.py | 150 +++++++++++
tests/unit_tests/databases/schema_tests.py | 15 ++
tests/unit_tests/db_engine_specs/test_presto.py | 24 ++
tests/unit_tests/jinja_context_test.py | 19 ++
tests/unit_tests/key_value/prune_test.py | 168 ++++++++++++
tests/unit_tests/mcp_service/test_auth_api_key.py | 6 +-
.../mcp_service/test_auth_user_resolution.py | 70 ++++-
tests/unit_tests/mcp_service/test_jwt_verifier.py | 66 ++++-
tests/unit_tests/mcp_service/test_middleware.py | 6 +-
.../mcp_service/utils/test_error_sanitization.py | 70 +++++
.../mcp_service/utils/test_permissions_utils.py | 37 ++-
tests/unit_tests/models/dashboard_test.py | 52 ++++
tests/unit_tests/models/slice_test.py | 25 +-
.../reports/notifications/email_tests.py | 35 +++
tests/unit_tests/sql/execution/test_celery_task.py | 60 +++++
tests/unit_tests/sql/parse_tests.py | 44 ++++
.../common => tests/unit_tests/sqllab}/__init__.py | 0
tests/unit_tests/sqllab/api_test.py | 64 +++++
tests/unit_tests/test_sqllab_error_stacktrace.py | 282 +++++++++++++++++++++
tests/unit_tests/utils/csv_tests.py | 40 +++
tests/unit_tests/utils/excel_tests.py | 37 ++-
tests/unit_tests/utils/test_core.py | 41 +++
tests/unit_tests/views/test_base.py | 34 +++
tests/unit_tests/views/test_base_theme_helpers.py | 56 +++-
170 files changed, 5144 insertions(+), 490 deletions(-)
create mode 100644 superset-frontend/plugins/plugin-chart-ag-grid-table/test/stateConversion.test.ts
create mode 100644 superset-frontend/plugins/plugin-chart-echarts/test/Histogram/buildQuery.test.ts
copy superset-frontend/src/{components/TimePicker/index.tsx => SqlLab/hooks/useAppDispatch.ts} (61%)
copy superset-frontend/src/{components/FacePile/types.ts => SqlLab/hooks/useAppSelector.ts} (73%)
create mode 100644 superset-frontend/src/dashboard/components/PropertiesModal/utils.test.ts
create mode 100644 superset-frontend/src/dashboard/components/PropertiesModal/utils.ts
create mode 100644 superset-frontend/src/embedded/originValidation.test.ts
create mode 100644 superset-frontend/src/embedded/originValidation.ts
create mode 100644 superset-frontend/src/features/databases/DatabaseModal/DatabaseConnectionForm/DatabaseConnectionForm.test.tsx
create mode 100644 superset-frontend/src/features/databases/DatabaseModal/DatabaseConnectionForm/TableCatalog.test.tsx
copy {superset-core/src/superset_core/common => superset/key_value/commands}/__init__.py (100%)
create mode 100644 superset/key_value/commands/prune.py
copy {superset-frontend/packages/superset-ui-core/src/components/assets/images => superset/templates/superset}/loading.svg (100%)
copy {superset-core/src/superset_core/common => tests/unit_tests/commands/logs}/__init__.py (100%)
create mode 100644 tests/unit_tests/commands/logs/prune_test.py
create mode 100644 tests/unit_tests/key_value/prune_test.py
create mode 100644 tests/unit_tests/mcp_service/utils/test_error_sanitization.py
create mode 100644 tests/unit_tests/models/dashboard_test.py
copy {superset-core/src/superset_core/common => tests/unit_tests/sqllab}/__init__.py (100%)
create mode 100644 tests/unit_tests/sqllab/api_test.py
create mode 100644 tests/unit_tests/test_sqllab_error_stacktrace.py