You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@superset.apache.org by am...@apache.org on 2026/09/01 16:22:00 UTC
(superset) 10/15: fix(embedded): don't 500 on a malformed Referer
This is an automated email from the ASF dual-hosted git repository.
amaannawab923 pushed a commit to branch feat/embedded-chart
in repository https://gitbox.apache.org/repos/asf/superset.git
commit b9472c351aad9b402b8eb01faa7bba5ee5b9a2fb
Author: amaannawab923 <am...@gmail.com>
AuthorDate: Tue Sep 1 20:55:24 2026 +0530
fix(embedded): don't 500 on a malformed Referer
same_origin parses the referrer eagerly, so an attacker-controlled value whose
authority looks like it carries a non-numeric port (for example
http://localhost:3007.evil.com/) raised ValueError instead of returning False.
Access already failed closed, but any anonymous client could turn one header
into a stack trace. This is not specific to embedded charts: the same path
serves embedded dashboards today.
---
superset/embedded/view.py | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/superset/embedded/view.py b/superset/embedded/view.py
index c5fb3be814d..c9daed10020 100644
--- a/superset/embedded/view.py
+++ b/superset/embedded/view.py
@@ -75,9 +75,16 @@ class EmbeddedView(BaseSupersetView):
# validate request referrer in allowed domains
is_referrer_allowed = not embedded.allowed_domains
for domain in embedded.allowed_domains:
- if same_origin(request.referrer, domain):
- is_referrer_allowed = True
- break
+ try:
+ if same_origin(request.referrer, domain):
+ is_referrer_allowed = True
+ break
+ except ValueError:
+ # The referrer is attacker-controlled and same_origin parses it
+ # eagerly, so a malformed authority (e.g. a host that looks like
+ # it carries a non-numeric port) raises rather than returning
+ # False. Treat it as a non-match instead of a 500.
+ continue
if not is_referrer_allowed:
abort(403)