You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "chakilamsuryat (via GitHub)" <gi...@apache.org> on 2025/01/06 11:16:00 UTC
[I] No input validations there on UI [superset]
chakilamsuryat opened a new issue, #31723:
URL: https://github.com/apache/superset/issues/31723
## Screenshot
<img width="1790" alt="Screenshot 2025-01-06 at 4 40 40 PM" src="https://github.com/user-attachments/assets/38e53069-3745-4006-8b8d-2742a7e7a5f4" />
## Description
There is no input validation present for Dashboard, Chart, Annotation Layers, row-level-security, and for user info details
## Design input
In the module specific {charts, dashboards, annotation_layers, row_level_security, etc} schemas.py files, can add input validation like:- validate=[validate.And(Length(1, 250),validate.Regexp(regex='^[a-zA-Z0-9_]+$',error='Special Characters are not Allowed!'))] for the fields for which it is needed like name, description because if no validation is there then any attack is possible like they can give some scripts to be in name/description which might cause a vulnerability. For Userinfo input validations for first_name and last_name can create new view in our superset/security/manager.py and can add like:- [userinfoeditview = NewUserInfoEditView] in SuperSetSecurityManager.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] No input validations there on UI [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on issue #31723:
URL: https://github.com/apache/superset/issues/31723#issuecomment-2581153471
A limit on length sounds reasonable, but I'm not sure what it really ought to be... perhaps that should be configurable.
Similarly, for disallowing characters in names/titles, if there is an XSS vulnerability or something, I'm onboard, but otherwise I think special characters should be fine. I might want a chart of "Top 1% of songs written in D# minor, by $ earned"
Of course, again I'm fine with imposing a list of "banned" characters, so long as that's part of the config.
A PR would be welcome. Meanwhile, I'll convert this to an Ideas discussion, since I don't think it's a bug report. CC @dpgaspar as well since this might border on security.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] No input validations there on UI [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas closed issue #31723: No input validations there on UI
URL: https://github.com/apache/superset/issues/31723
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] No input validations there on UI [superset]
Posted by "chakilamsuryat (via GitHub)" <gi...@apache.org>.
chakilamsuryat commented on issue #31723:
URL: https://github.com/apache/superset/issues/31723#issuecomment-2572899626
I have made these all changes as we have some security vulnerability issues raised and we are currently running updated code from our end.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org