You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@superset.apache.org by ru...@apache.org on 2026/06/16 18:57:06 UTC
(superset) branch fix/scarf-pixel-static-url created (now a094976dcdb)
This is an automated email from the ASF dual-hosted git repository.
rusackas pushed a change to branch fix/scarf-pixel-static-url
in repository https://gitbox.apache.org/repos/asf/superset.git
at a094976dcdb fix(telemetry): use Scarf static pixel instead of gateway redirect
This branch includes the following new commits:
new a094976dcdb fix(telemetry): use Scarf static pixel instead of gateway redirect
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(superset) 01/01: fix(telemetry): use Scarf static pixel instead of gateway redirect
Posted by ru...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rusackas pushed a commit to branch fix/scarf-pixel-static-url
in repository https://gitbox.apache.org/repos/asf/superset.git
commit a094976dcdbc9a668da2a3abda18dbde3b7e52cd
Author: Superset Dev <de...@superset.apache.org>
AuthorDate: Tue Jun 16 11:55:31 2026 -0700
fix(telemetry): use Scarf static pixel instead of gateway redirect
The in-app telemetry pixel pointed at the Scarf Gateway redirect
(apachesuperset.gateway.scarf.sh/pixel/...), which Chrome/Brave/Firefox
and some extensions flag as a tracking redirect — surfacing Superset as a
"dangerous"/phishing site for some users (#32110).
Point the pixel at Scarf's native static endpoint that the gateway route
already forwards to:
https://static.scarf.sh/a.png?x-pxid=<id>&version=..&sha=..&build=..
Same pixel ID and the same version/sha/build dimensions (now query params),
so telemetry is unchanged — only the flagged redirect hop is removed. CSP
already allowed static.scarf.sh; drop the now-unused gateway host from the
img-src allowlists (and the security docs example) since nothing in the
browser loads from it anymore.
Co-Authored-By: Claude Fable 5 <no...@anthropic.com>
---
docs/admin_docs/security/security.mdx | 1 -
.../src/components/TelemetryPixel/TelemetryPixel.test.tsx | 9 +++++++--
.../superset-ui-core/src/components/TelemetryPixel/index.tsx | 9 ++++++++-
superset/config.py | 2 --
4 files changed, 15 insertions(+), 6 deletions(-)
diff --git a/docs/admin_docs/security/security.mdx b/docs/admin_docs/security/security.mdx
index 6190925d8ab..97168068586 100644
--- a/docs/admin_docs/security/security.mdx
+++ b/docs/admin_docs/security/security.mdx
@@ -592,7 +592,6 @@ TALISMAN_CONFIG = {
"'self'",
"blob:",
"data:",
- "https://apachesuperset.gateway.scarf.sh",
"https://static.scarf.sh/",
# "https://cdn.brandfolder.io", # Uncomment when SLACK_ENABLE_AVATARS is True # noqa: E501
"ows.terrestris.de",
diff --git a/superset-frontend/packages/superset-ui-core/src/components/TelemetryPixel/TelemetryPixel.test.tsx b/superset-frontend/packages/superset-ui-core/src/components/TelemetryPixel/TelemetryPixel.test.tsx
index b7b32ebc3bf..a3050b71acc 100644
--- a/superset-frontend/packages/superset-ui-core/src/components/TelemetryPixel/TelemetryPixel.test.tsx
+++ b/superset-frontend/packages/superset-ui-core/src/components/TelemetryPixel/TelemetryPixel.test.tsx
@@ -33,10 +33,15 @@ test('should render', () => {
test('should render the pixel link when FF is on', () => {
process.env.SCARF_ANALYTICS = 'true';
- render(<TelemetryPixel />);
+ render(<TelemetryPixel version="1.2.3" sha="abc" build="42" />);
- const image = document.querySelector('img[src*="scarf.sh"]');
+ // Hits Scarf's static pixel directly, not the gateway redirect that browsers flag
+ const image = document.querySelector('img[src^="https://static.scarf.sh/"]');
expect(image).toBeInTheDocument();
+ expect(image?.getAttribute('src')).toContain('version=1.2.3');
+ expect(image?.getAttribute('src')).toContain('sha=abc');
+ expect(image?.getAttribute('src')).toContain('build=42');
+ expect(document.querySelector('img[src*="gateway.scarf.sh"]')).toBeNull();
});
test('should NOT render the pixel link when FF is off', () => {
diff --git a/superset-frontend/packages/superset-ui-core/src/components/TelemetryPixel/index.tsx b/superset-frontend/packages/superset-ui-core/src/components/TelemetryPixel/index.tsx
index f0e3062dabd..1abcecc4a19 100644
--- a/superset-frontend/packages/superset-ui-core/src/components/TelemetryPixel/index.tsx
+++ b/superset-frontend/packages/superset-ui-core/src/components/TelemetryPixel/index.tsx
@@ -53,7 +53,14 @@ export const TelemetryPixel = ({
build = 'unknownBuild',
enabled = true,
}: TelemetryPixelProps): ReactElement | null => {
- const pixelPath = `https://apachesuperset.gateway.scarf.sh/pixel/${PIXEL_ID}/${version}/${sha}/${build}`;
+ // Use Scarf's native static pixel directly rather than the gateway redirect
+ // (apachesuperset.gateway.scarf.sh), which some browsers/extensions flag as a
+ // tracking redirect. The gateway route forwards to this same static endpoint.
+ const pixelPath =
+ `https://static.scarf.sh/a.png?x-pxid=${PIXEL_ID}` +
+ `&version=${encodeURIComponent(version)}` +
+ `&sha=${encodeURIComponent(sha)}` +
+ `&build=${encodeURIComponent(build)}`;
const disabled = !enabled || process.env.SCARF_ANALYTICS === 'false';
return disabled ? null : (
<img
diff --git a/superset/config.py b/superset/config.py
index 42fbe54993a..5084982af74 100644
--- a/superset/config.py
+++ b/superset/config.py
@@ -2279,7 +2279,6 @@ TALISMAN_CONFIG = {
"'self'",
"blob:",
"data:",
- "https://apachesuperset.gateway.scarf.sh",
"https://static.scarf.sh/",
# "https://cdn.brandfolder.io", # Uncomment when SLACK_ENABLE_AVATARS is True # noqa: E501
"ows.terrestris.de",
@@ -2326,7 +2325,6 @@ TALISMAN_DEV_CONFIG = {
"'self'",
"blob:",
"data:",
- "https://apachesuperset.gateway.scarf.sh",
"https://static.scarf.sh/",
"https://cdn.brandfolder.io",
"ows.terrestris.de",