(superset) branch fix/sanitize-client-error-message-when-shown-as-html-content created (now d250eacaee7)

[ha...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

hainenber pushed a change to branch fix/sanitize-client-error-message-when-shown-as-html-content
in repository https://gitbox.apache.org/repos/asf/superset.git


      at d250eacaee7 fix(frontend/setup): sanitize returned client error message when shown as HTML content

This branch includes the following new commits:

     new d250eacaee7 fix(frontend/setup): sanitize returned client error message when shown as HTML content

The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.

(superset) 01/01: fix(frontend/setup): sanitize returned client error message when shown as HTML content

[ha...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

hainenber pushed a commit to branch fix/sanitize-client-error-message-when-shown-as-html-content
in repository https://gitbox.apache.org/repos/asf/superset.git

commit d250eacaee76c09ff5ec22af684c363979612b0d
Author: hainenber <do...@gmail.com>
AuthorDate: Sat Jul 4 14:56:04 2026 +0700

    fix(frontend/setup): sanitize returned client error message when shown as HTML content
    
    Signed-off-by: hainenber <do...@gmail.com>
---
 superset-frontend/src/setup/setupApp.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/superset-frontend/src/setup/setupApp.ts b/superset-frontend/src/setup/setupApp.ts
index 23bd5780231..b1063ede621 100644
--- a/superset-frontend/src/setup/setupApp.ts
+++ b/superset-frontend/src/setup/setupApp.ts
@@ -22,6 +22,7 @@ import {
   SupersetClient,
   getClientErrorObject,
   ClientErrorObject,
+  sanitizeHtmlIfNeeded,
 } from '@superset-ui/core';
 import setupErrorMessages from 'src/setup/setupErrorMessages';
 
@@ -41,7 +42,7 @@ function showApiMessage(resp: ClientErrorObject) {
   const severity = resp.severity || 'info';
   $(template)
     .addClass(`alert-${severity}`)
-    .append(resp.message || '')
+    .append(resp.message ? sanitizeHtmlIfNeeded(resp.message) : '')
     .appendTo($('#alert-container'));
 }