You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "rusackas (via GitHub)" <gi...@apache.org> on 2026/06/02 02:01:54 UTC

[PR] fix: harden ZIP safety checks (total-size cap, zero-division guard) and extension path matching [superset]

rusackas opened a new pull request, #40664:
URL: https://github.com/apache/superset/pull/40664

   ### SUMMARY
   
   Defense-in-depth hardening for ZIP/extension processing:
   
   - **`check_is_safe_zip`** (`superset/utils/core.py`) enforced only per-file size and the per-archive compression ratio. It did **not** bound the **total** decompressed size — an archive of many individually-allowed entries (each ≤ `ZIPPED_FILE_MAX_SIZE`, ratio ≤ `ZIP_FILE_MAX_COMPRESS_RATIO`) could still sum to a very large decompressed total and exhaust memory. Added a `ZIP_FILE_MAX_TOTAL_SIZE` cap (default 1GB). Also guarded the ratio division so an entry reporting `compress_size == 0` raises a clean `SupersetException` instead of `ZeroDivisionError`.
   - **`BACKEND_REGEX`** (`superset/extensions/utils.py`) used `(.+)`, which could capture `..` components. Tightened to reject parent-path components (defense-in-depth; `check_is_safe_zip` already runs before extraction, and the capture is used to build an in-memory module name rather than a filesystem path).
   
   (Note: FINDING-035 — import filename-extension validation — is intentionally **not** included; the `is_zipfile()` content check is the authoritative, stronger validation, and requiring a `.zip` extension would risk breaking API clients for negligible benefit. FINDING-034/036 were confirmed already-mitigated.)
   
   ### TESTING INSTRUCTIONS
   
   ```
   pytest tests/unit_tests/utils/test_core.py -k safe_zip
   ```
   
   New tests: total decompressed size over the cap is rejected; a zero compressed size no longer raises `ZeroDivisionError`.
   
   ### ADDITIONAL INFORMATION
   
   - [ ] Has associated issue:
   - [ ] Required feature flags:
   - [ ] Changes UI
   - [ ] Includes DB Migration
   - [ ] Introduces new feature or API
   - [ ] Removes existing feature or API
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] fix: harden ZIP safety checks (total-size cap, zero-division guard) and extension path matching [superset]

Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on code in PR #40664:
URL: https://github.com/apache/superset/pull/40664#discussion_r3338285462


##########
superset/extensions/utils.py:
##########
@@ -36,7 +36,9 @@
 logger = logging.getLogger(__name__)
 
 FRONTEND_REGEX = re.compile(r"^frontend/dist/([^/]+)$")
-BACKEND_REGEX = re.compile(r"^backend/src/(.+)$")
+# Reject parent ("..") path components so a crafted entry name cannot produce
+# a traversal-style module path (defense in depth; check_is_safe_zip runs first).
+BACKEND_REGEX = re.compile(r"^backend/src/(?!.*\.\.)(.+)$")

Review Comment:
   <div>
   
   
   <div id="suggestion">
   <div id="issue"><b>CWE-22: Path Traversal Regex Too Aggressive</b></div>
   <div id="fix">
   
   The negative lookahead `(?!.*\.\.)` rejects ANY path containing `..` anywhere, breaking legitimate filenames like `file..`, `..hidden`, or `package..init`. Only path traversal (`/../`) should be rejected, not dots embedded in filenames. (See also: [CWE-22](https://cwe.mitre.org/data/definitions/22.html))
   </div>
   
   
   <details>
   <summary>
   <b>Code suggestion</b>
   </summary>
   <blockquote>Check the AI-generated fix before applying</blockquote>
   <div id="code">
   
   
   ```
    --- superset/extensions/utils.py (lines 38-42) ---
    38: FRONTEND_REGEX = re.compile(r"^frontend/dist/([^/]+)$")
    39: # Reject parent ("..") path components so a crafted entry name cannot produce
    40: # a traversal-style module path (defense in depth; check_is_safe_zip runs first).
    41: -BACKEND_REGEX = re.compile(r"^backend/src/(?!.*\.\.)(.+)$")
    41: +BACKEND_REGEX = re.compile(r"^backend/src/(?!(?:[^/]*/)?\.\.(?:/|$))(.+)$")
   ```
   
   </div>
   </details>
   
   
   
   </div>
   
   
   
   
   <small><i>Code Review Run #03baa9</i></small>
   </div>
   
   ---
   Should Bito avoid suggestions like this for future reviews? (<a href=https://alpha.bito.ai/home/ai-agents/review-rules>Manage Rules</a>)
   - [ ] Yes, avoid them



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] fix: harden ZIP safety checks (total-size cap, zero-division guard) and extension path matching [superset]

Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #40664:
URL: https://github.com/apache/superset/pull/40664#issuecomment-4598077380

   AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] fix: harden ZIP safety checks (total-size cap, zero-division guard) and extension path matching [superset]

Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on code in PR #40664:
URL: https://github.com/apache/superset/pull/40664#discussion_r3338370386


##########
superset/extensions/utils.py:
##########
@@ -36,7 +36,9 @@
 logger = logging.getLogger(__name__)
 
 FRONTEND_REGEX = re.compile(r"^frontend/dist/([^/]+)$")
-BACKEND_REGEX = re.compile(r"^backend/src/(.+)$")
+# Reject parent ("..") path components so a crafted entry name cannot produce
+# a traversal-style module path (defense in depth; check_is_safe_zip runs first).
+BACKEND_REGEX = re.compile(r"^backend/src/(?!.*\.\.)(.+)$")

Review Comment:
   Bito's follow-up reiterates the original suggestion even after the explanation above. The conservative `(?!.*\.\.)` guard is intentional — extension module paths are Python import names and never contain consecutive dots in practice, and `check_is_safe_zip` is the primary defense. Bito's proposed replacement would incorrectly allow `..`-prefixed components; the current pattern is the right call.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] fix: harden ZIP safety checks (total-size cap, zero-division guard) and extension path matching [superset]

Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #40664:
URL: https://github.com/apache/superset/pull/40664#issuecomment-4654358407

   **Bito Automatic Review Skipped – PR Already Merged**<br/><br/>Bito scheduled an automatic review for this pull request, but the review was skipped because this PR was merged before the review could be run.<br/>No action is needed if you didn't intend to review it. To get a review, you can type `/review` in a comment and save it


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] fix: harden ZIP safety checks (total-size cap, zero-division guard) and extension path matching [superset]

Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on code in PR #40664:
URL: https://github.com/apache/superset/pull/40664#discussion_r3338307320


##########
superset/extensions/utils.py:
##########
@@ -36,7 +36,9 @@
 logger = logging.getLogger(__name__)
 
 FRONTEND_REGEX = re.compile(r"^frontend/dist/([^/]+)$")
-BACKEND_REGEX = re.compile(r"^backend/src/(.+)$")
+# Reject parent ("..") path components so a crafted entry name cannot produce
+# a traversal-style module path (defense in depth; check_is_safe_zip runs first).
+BACKEND_REGEX = re.compile(r"^backend/src/(?!.*\.\.)(.+)$")

Review Comment:
   <!-- Bito Reply -->
   The suggestion provided by Bito aims to address a potential path traversal vulnerability by adjusting the regex pattern. However, the user's response indicates that the current pattern is intentionally conservative and that the proposed change might introduce unintended behavior by allowing certain forms of traversal. Given the user's explanation and the context of the code, it seems that the current implementation is a deliberate design choice to ensure security. Therefore, Bito should consider the user's feedback and potentially refine the suggestion to align with the intended security measures.
   
   **superset/extensions/utils.py**
   ```
   38: FRONTEND_REGEX = re.compile(r""^frontend/dist/([^/]+)$"")
   39: # Reject parent ("".."") path components so a crafted entry name cannot produce
   40: # a traversal-style module path (defense in depth; check_is_safe_zip runs first).
   41: -BACKEND_REGEX = re.compile(r""^backend/src/(?!.*\.\.)(.+)$"")
   41: +BACKEND_REGEX = re.compile(r""^backend/src/(?!(?:[^/]*/)?\.\.(?:/|$))(.+)$"")
   ```



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] fix: harden ZIP safety checks (total-size cap, zero-division guard) and extension path matching [superset]

Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on code in PR #40664:
URL: https://github.com/apache/superset/pull/40664#discussion_r3338305903


##########
superset/extensions/utils.py:
##########
@@ -36,7 +36,9 @@
 logger = logging.getLogger(__name__)
 
 FRONTEND_REGEX = re.compile(r"^frontend/dist/([^/]+)$")
-BACKEND_REGEX = re.compile(r"^backend/src/(.+)$")
+# Reject parent ("..") path components so a crafted entry name cannot produce
+# a traversal-style module path (defense in depth; check_is_safe_zip runs first).
+BACKEND_REGEX = re.compile(r"^backend/src/(?!.*\.\.)(.+)$")

Review Comment:
   The concern about  blocking filenames containing literal  (like ) is noted, but in practice extension module paths () are Python-importable names — those never embed consecutive dots. The defense-in-depth comment already calls out that  runs first; the regex is a secondary guard for path-component traversal only. Also, bito's proposed replacement () would incorrectly *allow* entries like , which is another form of leading-dot traversal. The current pattern is intentionally conservative; will leave as-is.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] fix: harden ZIP safety checks (total-size cap, zero-division guard) and extension path matching [superset]

Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas merged PR #40664:
URL: https://github.com/apache/superset/pull/40664


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] fix: harden ZIP safety checks (total-size cap, zero-division guard) and extension path matching [superset]

Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on code in PR #40664:
URL: https://github.com/apache/superset/pull/40664#discussion_r3342385194


##########
superset/extensions/utils.py:
##########
@@ -36,7 +36,9 @@
 logger = logging.getLogger(__name__)
 
 FRONTEND_REGEX = re.compile(r"^frontend/dist/([^/]+)$")
-BACKEND_REGEX = re.compile(r"^backend/src/(.+)$")
+# Reject parent ("..") path components so a crafted entry name cannot produce
+# a traversal-style module path (defense in depth; check_is_safe_zip runs first).
+BACKEND_REGEX = re.compile(r"^backend/src/(?!.*\.\.)(.+)$")

Review Comment:
   Good catch on the comment/regex mismatch. Since I want to keep the conservative `(?!.*\.\.)` guard (extension module paths never embed consecutive dots in practice, and `check_is_safe_zip` is the primary defense), I updated the comment to accurately describe that it rejects any `..` substring rather than just parent-directory segments. Fixed in d47de893b0.



##########
superset/utils/core.py:
##########
@@ -2107,8 +2107,17 @@ def check_is_safe_zip(zip_file: ZipFile) -> None:
             raise SupersetException("Found file with size above allowed threshold")
         uncompress_size += zip_file_element.file_size
         compress_size += zip_file_element.compress_size
-    compress_ratio = uncompress_size / compress_size
-    if compress_ratio > app.config["ZIP_FILE_MAX_COMPRESS_RATIO"]:
+    # Bound the total decompressed size, not just the per-file size, so an
+    # archive of many individually-allowed entries cannot exhaust memory.
+    if uncompress_size > app.config["ZIP_FILE_MAX_TOTAL_SIZE"]:
+        raise SupersetException("Found total uncompressed size above allowed threshold")

Review Comment:
   Makes sense — moved the total-size cap inside the loop so it fails fast on the first entry that pushes the running total past `ZIP_FILE_MAX_TOTAL_SIZE`, and dropped the redundant post-loop check. Fixed in d47de893b0.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] fix: harden ZIP safety checks (total-size cap, zero-division guard) and extension path matching [superset]

Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #40664:
URL: https://github.com/apache/superset/pull/40664#discussion_r3338875130


##########
superset/extensions/utils.py:
##########
@@ -36,7 +36,9 @@
 logger = logging.getLogger(__name__)
 
 FRONTEND_REGEX = re.compile(r"^frontend/dist/([^/]+)$")
-BACKEND_REGEX = re.compile(r"^backend/src/(.+)$")
+# Reject parent ("..") path components so a crafted entry name cannot produce
+# a traversal-style module path (defense in depth; check_is_safe_zip runs first).
+BACKEND_REGEX = re.compile(r"^backend/src/(?!.*\.\.)(.+)$")

Review Comment:
   The comment says we reject parent-directory path *components* (".."), but the regex actually rejects any occurrence of the substring ".." anywhere in the path. Either tighten the regex to only exclude traversal segments or update the comment to match what the pattern really does.



##########
superset/utils/core.py:
##########
@@ -2107,8 +2107,17 @@ def check_is_safe_zip(zip_file: ZipFile) -> None:
             raise SupersetException("Found file with size above allowed threshold")
         uncompress_size += zip_file_element.file_size
         compress_size += zip_file_element.compress_size
-    compress_ratio = uncompress_size / compress_size
-    if compress_ratio > app.config["ZIP_FILE_MAX_COMPRESS_RATIO"]:
+    # Bound the total decompressed size, not just the per-file size, so an
+    # archive of many individually-allowed entries cannot exhaust memory.
+    if uncompress_size > app.config["ZIP_FILE_MAX_TOTAL_SIZE"]:
+        raise SupersetException("Found total uncompressed size above allowed threshold")

Review Comment:
   Minor optimization: the total uncompressed-size cap is enforced only after the loop. You could fail fast by checking `uncompress_size` against `ZIP_FILE_MAX_TOTAL_SIZE` inside the loop right after incrementing it, and remove the post-loop check.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] fix: harden ZIP safety checks (total-size cap, zero-division guard) and extension path matching [superset]

Posted by "netlify[bot] (via GitHub)" <gi...@apache.org>.
netlify[bot] commented on PR #40664:
URL: https://github.com/apache/superset/pull/40664#issuecomment-4598084400

   ### <span aria-hidden="true">✅</span> Deploy Preview for *superset-docs-preview* ready!
   
   
   |  Name | Link |
   |:-:|------------------------|
   |<span aria-hidden="true">🔨</span> Latest commit | d2039799dec8039e6fae63fdf63053109b5a574a |
   |<span aria-hidden="true">🔍</span> Latest deploy log | https://app.netlify.com/projects/superset-docs-preview/deploys/6a1e3993acb80700086e45a8 |
   |<span aria-hidden="true">😎</span> Deploy Preview | [https://deploy-preview-40664--superset-docs-preview.netlify.app](https://deploy-preview-40664--superset-docs-preview.netlify.app) |
   |<span aria-hidden="true">📱</span> Preview on mobile | <details><summary> Toggle QR Code... </summary><br /><br />![QR Code](https://app.netlify.com/qr-code/eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1cmwiOiJodHRwczovL2RlcGxveS1wcmV2aWV3LTQwNjY0LS1zdXBlcnNldC1kb2NzLXByZXZpZXcubmV0bGlmeS5hcHAifQ.NCVIQo7Lk3XhNNru2ByLfLRXtpWoAz2DCnRbkghE7qo)<br /><br />_Use your smartphone camera to open QR code link._</details> |
   |<span aria-hidden="true">🤖</span> Make changes | [Run an agent on this branch](https://app.netlify.com/projects/superset-docs-preview/agent-runs#q1YqKMrPLShRslJS0lFKKkrMS84AstMyK_SrMgt0M3ML8otKdDMSi1JS8zLz0oFqUlILcvIrPVOAqswSDVONLS2NE5OTLAzMDQwMLMxSTUwTLZRqAQ) |
   ---
   <!-- [superset-docs-preview Preview](https://deploy-preview-40664--superset-docs-preview.netlify.app) -->
   _To edit notification comments on pull requests, go to your [Netlify project configuration](https://app.netlify.com/projects/superset-docs-preview/configuration/notifications#deploy-notifications)._


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] fix: harden ZIP safety checks (total-size cap, zero-division guard) and extension path matching [superset]

Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #40664:
URL: https://github.com/apache/superset/pull/40664#issuecomment-4616447297

   AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
   
   <details>
   <summary>
   Bito Usage Guide
   </summary>
   
   **Commands**
         
   Type the following command in the pull request comment and save the comment.
         
   - `/review` - Manually triggers a full AI review.
   
   - `/pause` - Pauses automatic reviews on this pull request.
   - `/resume` - Resumes automatic reviews.
   - `/resolve` - Marks all Bito-posted review comments as resolved.
   - `/abort` - Cancels all in-progress reviews.
   
         
   Refer to the <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/available-commands" target="_blank" rel="noopener noreferrer">documentation</a> for additional commands.
         
   **Configuration**
   
   This repository uses `Superset` You can customize the agent settings <a href="https://alpha.bito.ai/home/ai-agents/code-review-agent" target="_blank" rel="noopener noreferrer">here</a> or contact your Bito workspace admin at evan@preset.io.
         
   **Documentation & Help**
   - <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/getting-started/install-run-using-bito-cloud/create-or-customize-an-agent-instance" target="_blank" rel="noopener noreferrer">Customize agent settings</a>
   - <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/implementing-custom-code-review-rules" target="_blank" rel="noopener noreferrer">Review rules</a>
   - <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent" target="_blank" rel="noopener noreferrer">General documentation</a>
   - <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/faqs" target="_blank" rel="noopener noreferrer">FAQ</a>
   
   </details>
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] fix: harden ZIP safety checks (total-size cap, zero-division guard) and extension path matching [superset]

Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #40664:
URL: https://github.com/apache/superset/pull/40664#issuecomment-4598096259

   ## [Codecov](https://app.codecov.io/gh/apache/superset/pull/40664?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
   :x: Patch coverage is `20.00000%` with `4 lines` in your changes missing coverage. Please review.
   :white_check_mark: Project coverage is 55.15%. Comparing base ([`a183582`](https://app.codecov.io/gh/apache/superset/commit/a183582291ea020bae95bc10969c73c0470459d3?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`d203979`](https://app.codecov.io/gh/apache/superset/commit/d2039799dec8039e6fae63fdf63053109b5a574a?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
   :warning: Report is 178 commits behind head on master.
   
   | [Files with missing lines](https://app.codecov.io/gh/apache/superset/pull/40664?dropdown=coverage&src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Patch % | Lines |
   |---|---|---|
   | [superset/utils/core.py](https://app.codecov.io/gh/apache/superset/pull/40664?src=pr&el=tree&filepath=superset%2Futils%2Fcore.py&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-c3VwZXJzZXQvdXRpbHMvY29yZS5weQ==) | 0.00% | [3 Missing :warning: ](https://app.codecov.io/gh/apache/superset/pull/40664?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
   | [superset/extensions/utils.py](https://app.codecov.io/gh/apache/superset/pull/40664?src=pr&el=tree&filepath=superset%2Fextensions%2Futils.py&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-c3VwZXJzZXQvZXh0ZW5zaW9ucy91dGlscy5weQ==) | 0.00% | [1 Missing :warning: ](https://app.codecov.io/gh/apache/superset/pull/40664?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
   > :exclamation:  There is a different number of reports uploaded between BASE (a183582) and HEAD (d203979). Click for more details.
   > 
   > <details><summary>HEAD has 162 uploads less than BASE</summary>
   >
   >| Flag | BASE (a183582) | HEAD (d203979) |
   >|------|------|------|
   >|python|138|2|
   >|presto|14|1|
   >|hive|14|1|
   ></details>
   
   <details><summary>Additional details and impacted files</summary>
   
   
   
   ```diff
   @@            Coverage Diff             @@
   ##           master   #40664      +/-   ##
   ==========================================
   - Coverage   64.18%   55.15%   -9.04%     
   ==========================================
     Files        2591     2651      +60     
     Lines      138471   142155    +3684     
     Branches    32120    32567     +447     
   ==========================================
   - Hits        88883    78410   -10473     
   - Misses      48056    63057   +15001     
   + Partials     1532      688     -844     
   ```
   
   | [Flag](https://app.codecov.io/gh/apache/superset/pull/40664/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
   |---|---|---|
   | [hive](https://app.codecov.io/gh/apache/superset/pull/40664/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `39.75% <20.00%> (+0.35%)` | :arrow_up: |
   | [mysql](https://app.codecov.io/gh/apache/superset/pull/40664/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
   | [postgres](https://app.codecov.io/gh/apache/superset/pull/40664/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
   | [presto](https://app.codecov.io/gh/apache/superset/pull/40664/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `41.36% <20.00%> (+0.27%)` | :arrow_up: |
   | [python](https://app.codecov.io/gh/apache/superset/pull/40664/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `41.42% <20.00%> (-19.14%)` | :arrow_down: |
   | [sqlite](https://app.codecov.io/gh/apache/superset/pull/40664/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
   | [unit](https://app.codecov.io/gh/apache/superset/pull/40664/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
   
   Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#carryforward-flags-in-the-pull-request-comment) to find out more.
   </details>
   
   [:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/apache/superset/pull/40664?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).   
   :loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
   <details><summary> :rocket: New features to boost your workflow: </summary>
   
   - :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
   - :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
   </details>


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] fix: harden ZIP safety checks (total-size cap, zero-division guard) and extension path matching [superset]

Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #40664:
URL: https://github.com/apache/superset/pull/40664#issuecomment-4605848383

   AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
   
   <details>
   <summary>
   Bito Usage Guide
   </summary>
   
   **Commands**
         
   Type the following command in the pull request comment and save the comment.
         
   - `/review` - Manually triggers a full AI review.
   
   - `/pause` - Pauses automatic reviews on this pull request.
   - `/resume` - Resumes automatic reviews.
   - `/resolve` - Marks all Bito-posted review comments as resolved.
   - `/abort` - Cancels all in-progress reviews.
   
         
   Refer to the <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/available-commands" target="_blank" rel="noopener noreferrer">documentation</a> for additional commands.
         
   **Configuration**
   
   This repository uses `Superset` You can customize the agent settings <a href="https://alpha.bito.ai/home/ai-agents/code-review-agent" target="_blank" rel="noopener noreferrer">here</a> or contact your Bito workspace admin at evan@preset.io.
         
   **Documentation & Help**
   - <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/getting-started/install-run-using-bito-cloud/create-or-customize-an-agent-instance" target="_blank" rel="noopener noreferrer">Customize agent settings</a>
   - <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/implementing-custom-code-review-rules" target="_blank" rel="noopener noreferrer">Review rules</a>
   - <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent" target="_blank" rel="noopener noreferrer">General documentation</a>
   - <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/faqs" target="_blank" rel="noopener noreferrer">FAQ</a>
   
   </details>
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org