You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "zufolo441 (via GitHub)" <gi...@apache.org> on 2025/12/21 09:40:04 UTC
[I] Deck.gl polygon error [superset]
zufolo441 opened a new issue, #36779:
URL: https://github.com/apache/superset/issues/36779
### Bug description
Hi, I have a lot of deck.gl polygon maps. In Superset 5.0 everything works.
<img width="2216" height="1570" alt="Image" src="https://github.com/user-attachments/assets/ffa27f9b-33d7-4f97-9b3e-1c8ba902d779" />
In Superset 6.0.0 map is rendered, but when the mouse hovers coloured part of map I get an error.
<img width="2904" height="624" alt="Image" src="https://github.com/user-attachments/assets/47133b7e-61df-449f-bd19-e44cc35aca09" />
Thank you for your attention.
### Screenshots/recordings
### Superset version
master / latest-dev
### Python version
3.9
### Node version
16
### Browser
Chrome
### Additional context
_No response_
### Checklist
- [ ] I have searched Superset docs and Slack and didn't find a solution to my problem.
- [ ] I have searched the GitHub issue tracker and didn't find a similar bug report.
- [ ] I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Deck.gl polygon error [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on issue #36779:
URL: https://github.com/apache/superset/issues/36779#issuecomment-4898887410
Thread resolved into known behaviors: the hover error is the strict CSP blocking eval for JS tooltip generators (operator config: add 'unsafe-eval' or avoid JS tooltips) and tooltip HTML sanitization is deliberate XSS hardening. A working tooltip pattern was shared and confirmed. Closing as answered/by-design, with the [deck.gl](http://deck.gl/) rewrite having landed since.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Deck.gl polygon error [superset]
Posted by "zufolo441 (via GitHub)" <gi...@apache.org>.
zufolo441 commented on issue #36779:
URL: https://github.com/apache/superset/issues/36779#issuecomment-3678715070
In Superset 6.0 there isn't this option. So, I have to use JavaScript tooltip generator. Why it doesn't render html anymore?
<img width="1762" height="688" alt="Image" src="https://github.com/user-attachments/assets/0b3ca810-abbb-49f0-a7cd-d77a70e8fd6f" />
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Deck.gl polygon error [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
dosubot[bot] commented on issue #36779:
URL: https://github.com/apache/superset/issues/36779#issuecomment-3678682566
<!-- Answer -->
There isn’t a way to use custom JavaScript tooltip generators in deck.gl polygons in Superset 6.0.0 without relaxing the Content Security Policy to allow `'unsafe-eval'`. The reason is that Superset evaluates your tooltip code using a sandboxed function that ultimately relies on dynamic code execution (like `eval` or `new Function`), which is blocked by strict CSP settings in production for security reasons [see source](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset-frontend/plugins/legacy-preset-chart-deckgl/src/utils/sandbox.ts#L19-L65).
Best practice is to avoid using custom JS tooltips unless absolutely necessary. Instead, you can build rich tooltips by shaping your query results in SQL or your dataset so that all the fields you want to show are available to Superset’s built-in tooltip renderer. This way, you don’t need to enable JS controls or relax CSP, and your deployment stays secure [see source](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/config.py#L1636-L1706).
If you need full JS tooltip flexibility, you’ll have to keep `'unsafe-eval'` enabled, but this is not recommended for production environments due to security risks.
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot).*
---
<sup>How did I do? [Good](https://app.dosu.dev/response-feedback/5f47ffe3-93c6-476b-b410-e8a2124fe9a2?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/5f47ffe3-93c6-476b-b410-e8a2124fe9a2?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/5f47ffe3-93c6-476b-b410-e8a2124fe9a2?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/5f47ffe3-93c6-476b-b410-e8a2124fe9a2?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/5f47ffe3-93c6-476b-b410-e8a2124fe9a2?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/5f47ffe3-93c6-476b-b410-e8a2124fe9a2?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/5f47ffe3-93c6-476b-b410-e8a2124fe9a2?feedback_type=other)</sup>
[](https://app.dosu.dev/a28d3c7e-a9d3-459e-9fb6-3a6f9ff4f357/ask?utm_source=github) [](https://cursor.com/link/prompt?text=There%20isn%E2%80%99t%20a%20way%20to%20use%20custom%20JavaScript%20tooltip%20generators%20in%20deck.gl%20polygons%20in%20Superset%206.0.0%20without%20relaxing%20the%20Content%20Security%20Policy%20to%20allow%20%60%27unsafe-eval%27%60.%20The%20reason%20is%20that%20Superset%20evaluates%20your%20tooltip%20code%20using%20a%20sandboxed%20function%20that%20ultimately%20relies%20on%20dynamic%20code%20execution%20%28like%20%60eval%60%20or%20%60new%20Function%60%29%2C%20which%20is%20blocked%20by%20strict%20CSP%20settings%20in%20production%20for%20security%20reasons%C2%A0%5Bsee%20source%5D%28https%3A//github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset-frontend/plugins/legacy-preset-chart-deckgl/src/utils/sandbox.ts%23L19-L65%29
.%0A%0ABest%20practice%20is%20to%20avoid%20using%20custom%20JS%20tooltips%20unless%20absolutely%20necessary.%20Instead%2C%20you%20can%20build%20rich%20tooltips%20by%20shaping%20your%20query%20results%20in%20SQL%20or%20your%20dataset%20so%20that%20all%20the%20fields%20you%20want%20to%20show%20are%20available%20to%20Superset%E2%80%99s%20built-in%20tooltip%20renderer.%20This%20way%2C%20you%20don%E2%80%99t%20need%20to%20enable%20JS%20controls%20or%20relax%20CSP%2C%20and%20your%20deployment%20stays%20secure%C2%A0%5Bsee%20source%5D%28https%3A//github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/config.py%23L1636-L1706%29.%0A%0AIf%20you%20need%20full%20JS%20tooltip%20flexibility%2C%20you%E2%80%99ll%20have%20to%20keep%20%60%27unsafe-eval%27%60%20enabled%2C%20but%20this%20is%20not%20recommended%20for%20production%20environments%20due%20to%20security%20risks.) [](htt
ps://go.dosu.dev/discord-bot) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/issues/36779)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Deck.gl polygon error [superset]
Posted by "ginorossivn-eng (via GitHub)" <gi...@apache.org>.
ginorossivn-eng commented on issue #36779:
URL: https://github.com/apache/superset/issues/36779#issuecomment-3881985109
@dosu here is the screenshot
<img width="1876" height="917" alt="Image" src="https://github.com/user-attachments/assets/18eda786-32dc-4421-a7a4-76f4612cc7ed" />
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Deck.gl polygon error [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on issue #36779:
URL: https://github.com/apache/superset/issues/36779#issuecomment-3739860834
@DamianPendrak any ideas on how to smooth this one out, perchance?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Deck.gl polygon error [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas closed issue #36779: Deck.gl polygon error
URL: https://github.com/apache/superset/issues/36779
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Deck.gl polygon error [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
dosubot[bot] commented on issue #36779:
URL: https://github.com/apache/superset/issues/36779#issuecomment-3678688759
<!-- Answer -->
Yes, to customize tooltips in deck.gl polygons without custom JavaScript (and without relaxing CSP), you need to include all the fields you want to display in your dataset and select them in the chart configuration. Superset will show these fields in the default tooltip.
If you want a specific format (like combining multiple values into one tooltip), you can create a new field in your SQL query or dataset that concatenates the values you want. For example, in SQL:
```sql
SELECT
territorio,
anno,
indicatore,
valore,
CONCAT(territorio, '\nAnno: ', anno, '\n', indicatore, '\n', valore) AS tooltip_text
FROM your_table
```
Then, in your chart, make sure to include `tooltip_text` as one of the columns. Superset will display this field in the tooltip. Note that HTML tags will be escaped and not rendered as markup—only plain text formatting (like newlines or separators) will appear in the tooltip [[source]](https://github.com/apache/superset/issues/35182#issuecomment-3305170167).
Best practice: use clear column names and pre-format values as needed in your data source. Avoid custom JavaScript for tooltips in production, as it's blocked by strict CSP for security reasons [[source]](https://github.com/apache/superset/issues/18696#issuecomment-1922293527).
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot).*
---
<sup>How did I do? [Good](https://app.dosu.dev/response-feedback/0844d094-57ba-4026-9f3a-6fc77d59e1dd?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/0844d094-57ba-4026-9f3a-6fc77d59e1dd?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/0844d094-57ba-4026-9f3a-6fc77d59e1dd?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/0844d094-57ba-4026-9f3a-6fc77d59e1dd?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/0844d094-57ba-4026-9f3a-6fc77d59e1dd?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/0844d094-57ba-4026-9f3a-6fc77d59e1dd?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/0844d094-57ba-4026-9f3a-6fc77d59e1dd?feedback_type=other)</sup>
[](https://app.dosu.dev/a28d3c7e-a9d3-459e-9fb6-3a6f9ff4f357/ask?utm_source=github) [](https://cursor.com/link/prompt?text=Yes%2C%20to%20customize%20tooltips%20in%20deck.gl%20polygons%20without%20custom%20JavaScript%20%28and%20without%20relaxing%20CSP%29%2C%20you%20need%20to%20include%20all%20the%20fields%20you%20want%20to%20display%20in%20your%20dataset%20and%20select%20them%20in%20the%20chart%20configuration.%20Superset%20will%20show%20these%20fields%20in%20the%20default%20tooltip.%0A%0AIf%20you%20want%20a%20specific%20format%20%28like%20combining%20multiple%20values%20into%20one%20tooltip%29%2C%20you%20can%20create%20a%20new%20field%20in%20your%20SQL%20query%20or%20dataset%20that%20concatenates%20the%20values%20you%20want.%20For%20example%2C%20in%20SQL%3A%0A%0A%60%60%60sql%0ASELECT%0A%20%20territorio%2C%0A%20%20anno%2C%0A%20%20indicatore%2C%0A%20%20valore%2C%0A%20%2
0CONCAT%28territorio%2C%20%27%5CnAnno%3A%20%27%2C%20anno%2C%20%27%5Cn%27%2C%20indicatore%2C%20%27%5Cn%27%2C%20valore%29%20AS%20tooltip_text%0AFROM%20your_table%0A%60%60%60%0A%0AThen%2C%20in%20your%20chart%2C%20make%20sure%20to%20include%20%60tooltip_text%60%20as%20one%20of%20the%20columns.%20Superset%20will%20display%20this%20field%20in%20the%20tooltip.%20Note%20that%20HTML%20tags%20will%20be%20escaped%20and%20not%20rendered%20as%20markup%E2%80%94only%20plain%20text%20formatting%20%28like%20newlines%20or%20separators%29%20will%20appear%20in%20the%20tooltip%20%5B%5Bsource%5D%5D%28https%3A//github.com/apache/superset/issues/35182%23issuecomment-3305170167%29.%0A%0ABest%20practice%3A%20use%20clear%20column%20names%20and%20pre-format%20values%20as%20needed%20in%20your%20data%20source.%20Avoid%20custom%20JavaScript%20for%20tooltips%20in%20production%2C%20as%20it%27s%20blocked%20by%20strict%20CSP%20for%20security%20reasons%20%5B%5Bsource%5D%5D%28https%3A//github.com/apache/superset/issues
/18696%23issuecomment-1922293527%29.) [](https://go.dosu.dev/discord-bot) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/issues/36779)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Deck.gl polygon error [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
dosubot[bot] commented on issue #36779:
URL: https://github.com/apache/superset/issues/36779#issuecomment-3881919594
<!-- Answer -->
To show province name (`tenTinh` as `name`) and code (`maTinh`) in the deck.gl Polygon tooltip, you need to include them inside the `properties` block of your GeoJSON feature. Superset tooltips only display fields present in the GeoJSON properties, not separate SQL columns [see source](https://github.com/apache/superset/issues/34748).
Update your SQL view so the `geojson` column outputs something like:
```sql
JSON_QUERY(
CONCAT(
'{"type":"Feature","geometry":', b.geojson,
',"properties":{"maTinh":"', d.maTinh,
'","name":"', d.tenTinh,
'","SoDiemKetNoi":', COUNT(f.maFact),
'}}'
)
) AS geojson
```
This ensures `maTinh`, `name`, and `SoDiemKetNoi` are available in the tooltip [see example](https://github.com/apache/superset/issues/33618). After updating your view, refresh your dataset in Superset and configure the chart to use the new `geojson` column as the polygon geometry and `SoDiemKetNoi` as the metric.
Limitations: tooltips only show plain text fields from properties; HTML is not rendered for security reasons [see details](https://github.com/apache/superset/pull/33791). Persistent labels on polygons are not supported—only tooltips on hover [see discussion](https://github.com/apache/superset/discussions/36554).
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot).*
---
<sup>How did I do? [Good](https://app.dosu.dev/response-feedback/f0eda733-b2bd-4f11-8b45-1890dcd2755f?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/f0eda733-b2bd-4f11-8b45-1890dcd2755f?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/f0eda733-b2bd-4f11-8b45-1890dcd2755f?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/f0eda733-b2bd-4f11-8b45-1890dcd2755f?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/f0eda733-b2bd-4f11-8b45-1890dcd2755f?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/f0eda733-b2bd-4f11-8b45-1890dcd2755f?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/f0eda733-b2bd-4f11-8b45-1890dcd2755f?feedback_type=other)</sup>
[](https://app.dosu.dev/a28d3c7e-a9d3-459e-9fb6-3a6f9ff4f357/ask?utm_source=github) [](https://cursor.com/link/prompt?text=To%20show%20province%20name%20%28%60tenTinh%60%20as%20%60name%60%29%20and%20code%20%28%60maTinh%60%29%20in%20the%20deck.gl%20Polygon%20tooltip%2C%20you%20need%20to%20include%20them%20inside%20the%20%60properties%60%20block%20of%20your%20GeoJSON%20feature.%20Superset%20tooltips%20only%20display%20fields%20present%20in%20the%20GeoJSON%20properties%2C%20not%20separate%20SQL%20columns%C2%A0%5Bsee%20source%5D%28https%3A//github.com/apache/superset/issues/34748%29.%0A%0AUpdate%20your%20SQL%20view%20so%20the%20%60geojson%60%20column%20outputs%20something%20like%3A%0A%0A%60%60%60sql%0AJSON_QUERY%28%0A%20%20%20%20CONCAT%28%0A%20%20%20%20%20%20%20%20%27%7B%22type%22%3A%22Feature%22%2C%22geometry%22%3A%27%2C%20b.geojson%2C%0A%20%20%20%20%20%20%20%20%27%2C%22p
roperties%22%3A%7B%22maTinh%22%3A%22%27%2C%20d.maTinh%2C%0A%20%20%20%20%20%20%20%20%27%22%2C%22name%22%3A%22%27%2C%20d.tenTinh%2C%0A%20%20%20%20%20%20%20%20%27%22%2C%22SoDiemKetNoi%22%3A%27%2C%20COUNT%28f.maFact%29%2C%0A%20%20%20%20%20%20%20%20%27%7D%7D%27%0A%20%20%20%20%29%0A%29%20AS%20geojson%0A%60%60%60%0A%0AThis%20ensures%20%60maTinh%60%2C%20%60name%60%2C%20and%20%60SoDiemKetNoi%60%20are%20available%20in%20the%20tooltip%C2%A0%5Bsee%20example%5D%28https%3A//github.com/apache/superset/issues/33618%29.%20After%20updating%20your%20view%2C%20refresh%20your%20dataset%20in%20Superset%20and%20configure%20the%20chart%20to%20use%20the%20new%20%60geojson%60%20column%20as%20the%20polygon%20geometry%20and%20%60SoDiemKetNoi%60%20as%20the%20metric.%0A%0ALimitations%3A%20tooltips%20only%20show%20plain%20text%20fields%20from%20properties%3B%20HTML%20is%20not%20rendered%20for%20security%20reasons%C2%A0%5Bsee%20details%5D%28https%3A//github.com/apache/superset/pull/33791%29.%20Persistent%20labels%
20on%20polygons%20are%20not%20supported%E2%80%94only%20tooltips%20on%20hover%C2%A0%5Bsee%20discussion%5D%28https%3A//github.com/apache/superset/discussions/36554%29.) [](https://go.dosu.dev/discord-bot) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/issues/36779)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Deck.gl polygon error [superset]
Posted by "ginorossivn-eng (via GitHub)" <gi...@apache.org>.
ginorossivn-eng commented on issue #36779:
URL: https://github.com/apache/superset/issues/36779#issuecomment-3881981417
@sudo I have included other (tenTinh, maTinh) as you recommended but it still only show the SoDiemKetNoi.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Deck.gl polygon error [superset]
Posted by "zufolo441 (via GitHub)" <gi...@apache.org>.
zufolo441 commented on issue #36779:
URL: https://github.com/apache/superset/issues/36779#issuecomment-3678705841
"Polygon" is a polygon, "metric" is a float. I can't use "tooltip_text" as a metric or polygon. In chart configuration there isn't a specific parameter for tooltip.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Deck.gl polygon error [superset]
Posted by "zufolo441 (via GitHub)" <gi...@apache.org>.
zufolo441 commented on issue #36779:
URL: https://github.com/apache/superset/issues/36779#issuecomment-3798220947
Hi, @alex-poor , thanks, I tried your suggestion by writing:
(d) => '${d.object.extraProps.territorio}<br/><br/> Anno: ${d.object.extraProps.anno}<br/> ${d.object.extraProps.indicatore}<br/> ${d.object.extraProps.valore}<br/>'
but the result is not as expected.
<img width="1260" height="1190" alt="Image" src="https://github.com/user-attachments/assets/abf5eb80-f4dd-43c1-ab4f-ab87d1d42d6d" />
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Deck.gl polygon error [superset]
Posted by "alex-poor (via GitHub)" <gi...@apache.org>.
alex-poor commented on issue #36779:
URL: https://github.com/apache/superset/issues/36779#issuecomment-3801349022
@zufolo441 I think the div tag is critical, try it like:
(d) => '<div>${d.object.extraProps.territorio}<br/><br/>
Anno: ${d.object.extraProps.anno}<br/>
${d.object.extraProps.indicatore}<br/>
${d.object.extraProps.valore}</div>
'
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Deck.gl polygon error [superset]
Posted by "ginorossivn-eng (via GitHub)" <gi...@apache.org>.
ginorossivn-eng commented on issue #36779:
URL: https://github.com/apache/superset/issues/36779#issuecomment-3881900545
CREATE OR ALTER VIEW dbo.VW_KET_NOI_BAN_DO
AS
SELECT
d.maTinh,
d.tenTinh AS name,
-- 🔥 BẮT BUỘC: wrap geometry thành Feature
JSON_QUERY(
CONCAT(
'{"type":"Feature","geometry":',
b.geojson,
'}'
)
) AS geojson,
COUNT(f.maFact) AS SoDiemKetNoi
FROM dbo.DanhMucTinh d
LEFT JOIN dbo.BanDoTinh b
ON d.maTinh = b.maTinh
LEFT JOIN dbo.FACT_KET_NOI f
ON d.maTinh = f.maTinh
WHERE b.geojson IS NOT NULL
GROUP BY
d.maTinh, d.tenTinh, b.geojson;
GO
Above is my original code in the SQL, but the map (deck.gl Polygon) only show the count (SoDiemKetNoi) when hovering, it didn't show the name of the provinces or the provinces' code. How to solve this problem? Thanks.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Deck.gl polygon error [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
dosubot[bot] commented on issue #36779:
URL: https://github.com/apache/superset/issues/36779#issuecomment-3678643195
<!-- Answer -->
The error you’re seeing in Superset 6.0.0 when hovering over deck.gl polygons is caused by stricter Content Security Policy (CSP) settings that block the use of `eval()` in the frontend. Recent updates to deck.gl and React dependencies, as well as changes in Superset’s webpack and CSP configuration, mean that some frontend code now requires `eval` or similar dynamic execution, which is blocked by default for security reasons in production builds ([source](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/config.py#L1636-L1702), [discussion](https://github.com/apache/superset/discussions/33957#discussioncomment-13600099)).
Superset’s default CSP does **not** allow `'unsafe-eval'` in `script-src`, which is recommended for security but can break frontend libraries that use `eval`. In development mode, you can enable `'unsafe-eval'` by using `TALISMAN_DEV_CONFIG`, but this is **not recommended for production** due to security risks ([source](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/config.py#L1636-L1702)).
**Workarounds for development/testing:**
- In your `superset_config.py`, you can temporarily enable `'unsafe-eval'` for development by setting:
```python
TALISMAN_ENABLED = True
TALISMAN_CONFIG = {
"content_security_policy": {
"script-src": ["'self'", "'unsafe-inline'", "'unsafe-eval'"],
# ...other directives...
}
}
```
- For production, the best practice is to avoid dependencies that require `eval` under strict CSP. There is no official guidance recommending `'unsafe-eval'` in production ([discussion](https://github.com/apache/superset/discussions/33957#discussioncomment-13600099)).
**Why this changed:**
Superset 6.0.0 updated deck.gl and React, and tightened CSP enforcement to comply with Apache Software Foundation security requirements. This means frontend code that previously worked may now fail if it relies on dynamic code execution ([source](https://github.com/apache/superset/pull/35743), [discussion](https://github.com/apache/superset/issues/35845#issuecomment-3636347489)).
If you need to suppress CSP warnings (but not errors), you can set:
```python
CONTENT_SECURITY_POLICY_WARNING = False
```
in `superset_config.py`, but this will not resolve eval blocking errors.
If you need more help with a minimal reproducible example or want to discuss possible upstream fixes, let me know!
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot).*
---
<sup>How did I do? [Good](https://app.dosu.dev/response-feedback/4c52a9b7-72fb-4be3-83c6-b7908e11d2fd?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/4c52a9b7-72fb-4be3-83c6-b7908e11d2fd?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/4c52a9b7-72fb-4be3-83c6-b7908e11d2fd?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/4c52a9b7-72fb-4be3-83c6-b7908e11d2fd?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/4c52a9b7-72fb-4be3-83c6-b7908e11d2fd?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/4c52a9b7-72fb-4be3-83c6-b7908e11d2fd?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/4c52a9b7-72fb-4be3-83c6-b7908e11d2fd?feedback_type=other)</sup>
[](https://app.dosu.dev/a28d3c7e-a9d3-459e-9fb6-3a6f9ff4f357/ask?utm_source=github) [](https://cursor.com/link/prompt?text=The%20error%20you%E2%80%99re%20seeing%20in%20Superset%206.0.0%20when%20hovering%20over%20deck.gl%20polygons%20is%20caused%20by%20stricter%20Content%20Security%20Policy%20%28CSP%29%20settings%20that%20block%20the%20use%20of%20%60eval%28%29%60%20in%20the%20frontend.%20Recent%20updates%20to%20deck.gl%20and%20React%20dependencies%2C%20as%20well%20as%20changes%20in%20Superset%E2%80%99s%20webpack%20and%20CSP%20configuration%2C%20mean%20that%20some%20frontend%20code%20now%20requires%20%60eval%60%20or%20similar%20dynamic%20execution%2C%20which%20is%20blocked%20by%20default%20for%20security%20reasons%20in%20production%20builds%C2%A0%28%5Bsource%5D%28https%3A//github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/config.py%23L1636
-L1702%29%2C%C2%A0%5Bdiscussion%5D%28https%3A//github.com/apache/superset/discussions/33957%23discussioncomment-13600099%29%29.%0A%0ASuperset%E2%80%99s%20default%20CSP%20does%20%2A%2Anot%2A%2A%20allow%20%60%27unsafe-eval%27%60%20in%20%60script-src%60%2C%20which%20is%20recommended%20for%20security%20but%20can%20break%20frontend%20libraries%20that%20use%20%60eval%60.%20In%20development%20mode%2C%20you%20can%20enable%20%60%27unsafe-eval%27%60%20by%20using%20%60TALISMAN_DEV_CONFIG%60%2C%20but%20this%20is%20%2A%2Anot%20recommended%20for%20production%2A%2A%20due%20to%20security%20risks%C2%A0%28%5Bsource%5D%28https%3A//github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/config.py%23L1636-L1702%29%29.%0A%0A%2A%2AWorkarounds%20for%20development/testing%3A%2A%2A%0A-%20In%20your%20%60superset_config.py%60%2C%20you%20can%20temporarily%20enable%20%60%27unsafe-eval%27%60%20for%20development%20by%20setting%3A%0A%20%20%60%60%60python%0A%20%20TALISMAN_ENABLED%20%3D%20Tr
ue%0A%20%20TALISMAN_CONFIG%20%3D%20%7B%0A%20%20%20%20%20%20%22content_security_policy%22%3A%20%7B%0A%20%20%20%20%20%20%20%20%20%20%22script-src%22%3A%20%5B%22%27self%27%22%2C%20%22%27unsafe-inline%27%22%2C%20%22%27unsafe-eval%27%22%5D%2C%0A%20%20%20%20%20%20%20%20%20%20%23%20...other%20directives...%0A%20%20%20%20%20%20%7D%0A%20%20%7D%0A%20%20%60%60%60%0A-%20For%20production%2C%20the%20best%20practice%20is%20to%20avoid%20dependencies%20that%20require%20%60eval%60%20under%20strict%20CSP.%20There%20is%20no%20official%20guidance%20recommending%20%60%27unsafe-eval%27%60%20in%20production%C2%A0%28%5Bdiscussion%5D%28https%3A//github.com/apache/superset/discussions/33957%23discussioncomment-13600099%29%29.%0A%0A%2A%2AWhy%20this%20changed%3A%2A%2A%20%20%0ASuperset%206.0.0%20updated%20deck.gl%20and%20React%2C%20and%20tightened%20CSP%20enforcement%20to%20comply%20with%20Apache%20Software%20Foundation%20security%20requirements.%20This%20means%20frontend%20code%20that%20previously%20worked%20ma
y%20now%20fail%20if%20it%20relies%20on%20dynamic%20code%20execution%C2%A0%28%5Bsource%5D%28https%3A//github.com/apache/superset/pull/35743%29%2C%C2%A0%5Bdiscussion%5D%28https%3A//github.com/apache/superset/issues/35845%23issuecomment-3636347489%29%29.%0A%0AIf%20you%20need%20to%20suppress%20CSP%20warnings%20%28but%20not%20errors%29%2C%20you%20can%20set%3A%0A%60%60%60python%0ACONTENT_SECURITY_POLICY_WARNING%20%3D%20False%0A%60%60%60%0Ain%20%60superset_config.py%60%2C%20but%20this%20will%20not%20resolve%20eval%20blocking%20errors.%0A%0AIf%20you%20need%20more%20help%20with%20a%20minimal%20reproducible%20example%20or%20want%20to%20discuss%20possible%20upstream%20fixes%2C%20let%20me%20know%21) [](https://go.dosu.dev/discord-bot) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//
github.com/apache/superset/issues/36779)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Deck.gl polygon error [superset]
Posted by "zufolo441 (via GitHub)" <gi...@apache.org>.
zufolo441 commented on issue #36779:
URL: https://github.com/apache/superset/issues/36779#issuecomment-3678680342
Hi,
editing
TALISMAN_CONFIG = {
"content_security_policy": {
"script-src": ["'self'", "'unsafe-inline'", "'unsafe-eval'"],
solves the specific problem because I have in Javascript tooltip generator this code:
function updateTooltip(object) {
return(
object.object.extraProps.territorio +
'<br/>'+
'<br/>' +
'Anno:' + object.object.extraProps.anno +
'<br/>' +
object.object.extraProps.indicatore +
'<br/>' +
object.object.extraProps.valore +
'<br/>'
);
}
for creating a better tooltip.
If I remove this code, Superset works without the need of modifying TALISMAN_CONFIG.
As far as you know is there a better solution?
Thanks for very quick reply!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Deck.gl polygon error [superset]
Posted by "zufolo441 (via GitHub)" <gi...@apache.org>.
zufolo441 commented on issue #36779:
URL: https://github.com/apache/superset/issues/36779#issuecomment-3678685870
So I have to create a specific field for tooltip, right?
How I have to use it for getting a formatted tooltip?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Deck.gl polygon error [superset]
Posted by "zufolo441 (via GitHub)" <gi...@apache.org>.
zufolo441 commented on issue #36779:
URL: https://github.com/apache/superset/issues/36779#issuecomment-3678699293
So, where do I have to " select it in the chart configuration" for showing it?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Deck.gl polygon error [superset]
Posted by "zufolo441 (via GitHub)" <gi...@apache.org>.
zufolo441 commented on issue #36779:
URL: https://github.com/apache/superset/issues/36779#issuecomment-3678694569
Hi, I don't understand. Superset shows text just because the field is called "tooltip_text"
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Deck.gl polygon error [superset]
Posted by "zufolo441 (via GitHub)" <gi...@apache.org>.
zufolo441 commented on issue #36779:
URL: https://github.com/apache/superset/issues/36779#issuecomment-3678677178
Hi,
editing
TALISMAN_CONFIG = {
"content_security_policy": {
"script-src": ["'self'", "'unsafe-inline'", "'unsafe-eval'"],
solves the problem.
Thanks!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Deck.gl polygon error [superset]
Posted by "alex-poor (via GitHub)" <gi...@apache.org>.
alex-poor commented on issue #36779:
URL: https://github.com/apache/superset/issues/36779#issuecomment-3795861668
@zufolo441 maybe you fixed this already but I had the same issue with deck.gl polygon in superset 6.0.0. the JS tooltip does render html but in a very particular way, in order to get the format in pic I use:
<img width="959" height="29" alt="Image" src="https://github.com/user-attachments/assets/65786ffd-0e30-40b9-af5f-ceea001c6d48" />
<img width="1116" height="570" alt="Image" src="https://github.com/user-attachments/assets/c11b558f-0f18-4bf7-bd42-961a9065332e" />
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Deck.gl polygon error [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
dosubot[bot] commented on issue #36779:
URL: https://github.com/apache/superset/issues/36779#issuecomment-3678696485
<!-- Answer -->
No, Superset does not show tooltip text just because a field is named "tooltip_text". The tooltip content in deck.gl polygon charts is determined by the fields you select in the chart configuration—typically the "name" field, the metric, and the line column. Any field you include in your dataset and select in the chart setup can appear in the tooltip; the field name itself does not matter or have any special meaning. If you want to display a custom-formatted value, you can create a new field (with any name) in your dataset and select it in the chart configuration, and Superset will show its value in the tooltip just like any other field.
[Reference: deck.gl Polygon tooltip logic](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset-frontend/plugins/legacy-preset-chart-deckgl/src/layers/Polygon/Polygon.tsx#L63-L158)
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot).*
---
<sup>How did I do? [Good](https://app.dosu.dev/response-feedback/c4d0e5d6-cfb8-402a-9e2e-07fc405147b8?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/c4d0e5d6-cfb8-402a-9e2e-07fc405147b8?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/c4d0e5d6-cfb8-402a-9e2e-07fc405147b8?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/c4d0e5d6-cfb8-402a-9e2e-07fc405147b8?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/c4d0e5d6-cfb8-402a-9e2e-07fc405147b8?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/c4d0e5d6-cfb8-402a-9e2e-07fc405147b8?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/c4d0e5d6-cfb8-402a-9e2e-07fc405147b8?feedback_type=other)</sup>
[](https://app.dosu.dev/a28d3c7e-a9d3-459e-9fb6-3a6f9ff4f357/ask?utm_source=github) [](https://cursor.com/link/prompt?text=No%2C%20Superset%20does%20not%20show%20tooltip%20text%20just%20because%20a%20field%20is%20named%20%22tooltip_text%22.%20The%20tooltip%20content%20in%20deck.gl%20polygon%20charts%20is%20determined%20by%20the%20fields%20you%20select%20in%20the%20chart%20configuration%E2%80%94typically%20the%20%22name%22%20field%2C%20the%20metric%2C%20and%20the%20line%20column.%20Any%20field%20you%20include%20in%20your%20dataset%20and%20select%20in%20the%20chart%20setup%20can%20appear%20in%20the%20tooltip%3B%20the%20field%20name%20itself%20does%20not%20matter%20or%20have%20any%20special%20meaning.%20If%20you%20want%20to%20display%20a%20custom-formatted%20value%2C%20you%20can%20create%20a%20new%20field%20%28with%20any%20name%29%20in%20your%20dataset%20and%20select%20it
%20in%20the%20chart%20configuration%2C%20and%20Superset%20will%20show%20its%20value%20in%20the%20tooltip%20just%20like%20any%20other%20field.%20%20%0A%5BReference%3A%20deck.gl%20Polygon%20tooltip%20logic%5D%28https%3A//github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset-frontend/plugins/legacy-preset-chart-deckgl/src/layers/Polygon/Polygon.tsx%23L63-L158%29) [](https://go.dosu.dev/discord-bot) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/issues/36779)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Deck.gl polygon error [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
dosubot[bot] commented on issue #36779:
URL: https://github.com/apache/superset/issues/36779#issuecomment-3678706891
<!-- Answer -->
You're right—there isn't a dedicated tooltip field in the deck.gl Polygon chart configuration. By default, tooltips show the polygon geometry (from the "Polygon" column), the metric, and sometimes the "name" field if present. You can't use a custom field like "tooltip_text" as the metric or polygon because those require specific data types (geometry for polygons, numeric for metrics) [example](https://github.com/apache/superset/blob/master/superset-frontend/packages/superset-ui-demo/storybook/stories/plugins/legacy-preset-chart-deckgl/Polygon/Polygon.stories.tsx).
If you want to display a custom-formatted value in the tooltip (like a concatenated string), you have two options:
1. **If your Superset version includes the "Customize tooltips template" feature** (recently added), you can use a Handlebars template to reference any column or metric in your dataset. In the chart's control panel, look for a "Customize tooltips template" field and use something like:
```
{{ tooltip_text }}
```
or combine fields as needed. If you leave the template empty, Superset falls back to the default tooltip [details](https://github.com/apache/superset/pull/34276).
2. **If you don't have the template feature**, you can only show fields that are selected as the metric, polygon column, or possibly as a "dimension" (if available in the UI). There is no way to add an arbitrary field to the tooltip unless you use the JavaScript controls (which require relaxing CSP, not recommended for production). In this case, you can pre-format your tooltip content in your dataset (e.g., as a string column), but it will only appear in the tooltip if you can select it as a dimension or if it's included by default.
In summary: you can't use "tooltip_text" as a metric or polygon, and there is no explicit tooltip field. If you have the tooltip template feature, use it to customize your tooltip. Otherwise, you're limited to the default fields shown in the tooltip.
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot).*
---
<sup>How did I do? [Good](https://app.dosu.dev/response-feedback/fc7d3f20-93af-40b8-b77d-940c3750b299?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/fc7d3f20-93af-40b8-b77d-940c3750b299?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/fc7d3f20-93af-40b8-b77d-940c3750b299?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/fc7d3f20-93af-40b8-b77d-940c3750b299?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/fc7d3f20-93af-40b8-b77d-940c3750b299?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/fc7d3f20-93af-40b8-b77d-940c3750b299?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/fc7d3f20-93af-40b8-b77d-940c3750b299?feedback_type=other)</sup>
[](https://app.dosu.dev/a28d3c7e-a9d3-459e-9fb6-3a6f9ff4f357/ask?utm_source=github) [](https://cursor.com/link/prompt?text=You%27re%20right%E2%80%94there%20isn%27t%20a%20dedicated%20tooltip%20field%20in%20the%20deck.gl%20Polygon%20chart%20configuration.%20By%20default%2C%20tooltips%20show%20the%20polygon%20geometry%20%28from%20the%20%22Polygon%22%20column%29%2C%20the%20metric%2C%20and%20sometimes%20the%20%22name%22%20field%20if%20present.%20You%20can%27t%20use%20a%20custom%20field%20like%20%22tooltip_text%22%20as%20the%20metric%20or%20polygon%20because%20those%20require%20specific%20data%20types%20%28geometry%20for%20polygons%2C%20numeric%20for%20metrics%29%C2%A0%5Bexample%5D%28https%3A//github.com/apache/superset/blob/master/superset-frontend/packages/superset-ui-demo/storybook/stories/plugins/legacy-preset-chart-deckgl/Polygon/Polygon.stories.tsx%29.%0A%0AIf%20you%20
want%20to%20display%20a%20custom-formatted%20value%20in%20the%20tooltip%20%28like%20a%20concatenated%20string%29%2C%20you%20have%20two%20options%3A%0A%0A1.%20%2A%2AIf%20your%20Superset%20version%20includes%20the%20%22Customize%20tooltips%20template%22%20feature%2A%2A%20%28recently%20added%29%2C%20you%20can%20use%20a%20Handlebars%20template%20to%20reference%20any%20column%20or%20metric%20in%20your%20dataset.%20In%20the%20chart%27s%20control%20panel%2C%20look%20for%20a%20%22Customize%20tooltips%20template%22%20field%20and%20use%20something%20like%3A%0A%20%20%20%60%60%60%0A%20%20%20%7B%7B%20tooltip_text%20%7D%7D%0A%20%20%20%60%60%60%0A%20%20%20or%20combine%20fields%20as%20needed.%20If%20you%20leave%20the%20template%20empty%2C%20Superset%20falls%20back%20to%20the%20default%20tooltip%C2%A0%5Bdetails%5D%28https%3A//github.com/apache/superset/pull/34276%29.%0A%0A2.%20%2A%2AIf%20you%20don%27t%20have%20the%20template%20feature%2A%2A%2C%20you%20can%20only%20show%20fields%20that%20are%20select
ed%20as%20the%20metric%2C%20polygon%20column%2C%20or%20possibly%20as%20a%20%22dimension%22%20%28if%20available%20in%20the%20UI%29.%20There%20is%20no%20way%20to%20add%20an%20arbitrary%20field%20to%20the%20tooltip%20unless%20you%20use%20the%20JavaScript%20controls%20%28which%20require%20relaxing%20CSP%2C%20not%20recommended%20for%20production%29.%20In%20this%20case%2C%20you%20can%20pre-format%20your%20tooltip%20content%20in%20your%20dataset%20%28e.g.%2C%20as%20a%20string%20column%29%2C%20but%20it%20will%20only%20appear%20in%20the%20tooltip%20if%20you%20can%20select%20it%20as%20a%20dimension%20or%20if%20it%27s%20included%20by%20default.%0A%0AIn%20summary%3A%20you%20can%27t%20use%20%22tooltip_text%22%20as%20a%20metric%20or%20polygon%2C%20and%20there%20is%20no%20explicit%20tooltip%20field.%20If%20you%20have%20the%20tooltip%20template%20feature%2C%20use%20it%20to%20customize%20your%20tooltip.%20Otherwise%2C%20you%27re%20limited%20to%20the%20default%20fields%20shown%20in%20the%20tooltip.)&
nbsp;[](https://go.dosu.dev/discord-bot) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/issues/36779)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Deck.gl polygon error [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
dosubot[bot] commented on issue #36779:
URL: https://github.com/apache/superset/issues/36779#issuecomment-3678701423
<!-- Answer -->
To show a field in the tooltip for a deck.gl Polygon chart, you need to include that field in your dataset and then select it in the chart's configuration panel under the "Query" section. The fields that appear in the tooltip are typically those you choose for "Polygon Column" (the geometry), "metric" (the value), and any other columns you select as dimensions or groupings. There isn't a dedicated "tooltip field" selector—Superset builds the tooltip from the fields you select for the chart's main configuration, like the metric and polygon column. If you want a custom-formatted value, create a new field in your dataset (with any name), and select it as one of these fields in the chart configuration.
If you want to use custom JavaScript for tooltips, you can use the "jsTooltip" option in the "Advanced" section, but this requires enabling JavaScript controls and relaxing your Content Security Policy, which is not recommended for production environments [see source](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset-frontend/plugins/legacy-preset-chart-deckgl/src/layers/Polygon/controlPanel.ts#L50-L218).
So, in short: add your field to the dataset, and select it as a metric, dimension, or polygon column in the chart's "Query" section. Superset will then include it in the tooltip.
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot).*
---
<sup>How did I do? [Good](https://app.dosu.dev/response-feedback/a052d4de-b81a-4712-8df5-75e68230fd2f?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/a052d4de-b81a-4712-8df5-75e68230fd2f?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/a052d4de-b81a-4712-8df5-75e68230fd2f?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/a052d4de-b81a-4712-8df5-75e68230fd2f?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/a052d4de-b81a-4712-8df5-75e68230fd2f?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/a052d4de-b81a-4712-8df5-75e68230fd2f?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/a052d4de-b81a-4712-8df5-75e68230fd2f?feedback_type=other)</sup>
[](https://app.dosu.dev/a28d3c7e-a9d3-459e-9fb6-3a6f9ff4f357/ask?utm_source=github) [](https://cursor.com/link/prompt?text=To%20show%20a%20field%20in%20the%20tooltip%20for%20a%20deck.gl%20Polygon%20chart%2C%20you%20need%20to%20include%20that%20field%20in%20your%20dataset%20and%20then%20select%20it%20in%20the%20chart%27s%20configuration%20panel%20under%20the%20%22Query%22%20section.%20The%20fields%20that%20appear%20in%20the%20tooltip%20are%20typically%20those%20you%20choose%20for%20%22Polygon%20Column%22%20%28the%20geometry%29%2C%20%22metric%22%20%28the%20value%29%2C%20and%20any%20other%20columns%20you%20select%20as%20dimensions%20or%20groupings.%20There%20isn%27t%20a%20dedicated%20%22tooltip%20field%22%20selector%E2%80%94Superset%20builds%20the%20tooltip%20from%20the%20fields%20you%20select%20for%20the%20chart%27s%20main%20configuration%2C%20like%20the%20metric%20and%2
0polygon%20column.%20If%20you%20want%20a%20custom-formatted%20value%2C%20create%20a%20new%20field%20in%20your%20dataset%20%28with%20any%20name%29%2C%20and%20select%20it%20as%20one%20of%20these%20fields%20in%20the%20chart%20configuration.%20%0A%0AIf%20you%20want%20to%20use%20custom%20JavaScript%20for%20tooltips%2C%20you%20can%20use%20the%20%22jsTooltip%22%20option%20in%20the%20%22Advanced%22%20section%2C%20but%20this%20requires%20enabling%20JavaScript%20controls%20and%20relaxing%20your%20Content%20Security%20Policy%2C%20which%20is%20not%20recommended%20for%20production%20environments%C2%A0%5Bsee%20source%5D%28https%3A//github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset-frontend/plugins/legacy-preset-chart-deckgl/src/layers/Polygon/controlPanel.ts%23L50-L218%29.%0A%0ASo%2C%20in%20short%3A%20add%20your%20field%20to%20the%20dataset%2C%20and%20select%20it%20as%20a%20metric%2C%20dimension%2C%20or%20polygon%20column%20in%20the%20chart%27s%20%22Query%22%20sect
ion.%20Superset%20will%20then%20include%20it%20in%20the%20tooltip.) [](https://go.dosu.dev/discord-bot) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/issues/36779)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Deck.gl polygon error [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
dosubot[bot] commented on issue #36779:
URL: https://github.com/apache/superset/issues/36779#issuecomment-3678716021
<!-- Answer -->
In Superset 6.0, HTML in tooltips (including those generated by the JavaScript tooltip generator) is escaped and sanitized for security reasons—this is to prevent XSS and other vulnerabilities. As a result, HTML tags like `<br/>` are shown as plain text instead of being rendered as line breaks or markup. This change was introduced to align with best practices and is enforced in both Handlebars custom charts and deck.gl tooltips ([source](https://github.com/apache/superset/issues/35182), [test code](https://github.com/apache/superset/blob/master/superset-frontend/packages/superset-ui-core/test/utils/tooltip.test.ts)).
The sanitizer removes or escapes unsafe HTML (like `<script>` tags and event handlers) and only allows a very limited set of safe tags. There is currently no supported way to allow arbitrary HTML in deck.gl tooltips, even with JS tooltip generators, unless you modify the code or the sanitizer configuration. This is a deliberate security measure in recent Superset versions.
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot).*
---
<sup>How did I do? [Good](https://app.dosu.dev/response-feedback/44e95c28-9da1-4cc2-85de-c8d5b993a262?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/44e95c28-9da1-4cc2-85de-c8d5b993a262?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/44e95c28-9da1-4cc2-85de-c8d5b993a262?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/44e95c28-9da1-4cc2-85de-c8d5b993a262?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/44e95c28-9da1-4cc2-85de-c8d5b993a262?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/44e95c28-9da1-4cc2-85de-c8d5b993a262?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/44e95c28-9da1-4cc2-85de-c8d5b993a262?feedback_type=other)</sup>
[](https://app.dosu.dev/a28d3c7e-a9d3-459e-9fb6-3a6f9ff4f357/ask?utm_source=github) [](https://cursor.com/link/prompt?text=In%20Superset%206.0%2C%20HTML%20in%20tooltips%20%28including%20those%20generated%20by%20the%20JavaScript%20tooltip%20generator%29%20is%20escaped%20and%20sanitized%20for%20security%20reasons%E2%80%94this%20is%20to%20prevent%20XSS%20and%20other%20vulnerabilities.%20As%20a%20result%2C%20HTML%20tags%20like%20%60%3Cbr/%3E%60%20are%20shown%20as%20plain%20text%20instead%20of%20being%20rendered%20as%20line%20breaks%20or%20markup.%20This%20change%20was%20introduced%20to%20align%20with%20best%20practices%20and%20is%20enforced%20in%20both%20Handlebars%20custom%20charts%20and%20deck.gl%20tooltips%C2%A0%28%5Bsource%5D%28https%3A//github.com/apache/superset/issues/35182%29%2C%20%5Btest%20code%5D%28https%3A//github.com/apache/superset/blob/master/superset-fronten
d/packages/superset-ui-core/test/utils/tooltip.test.ts%29%29.%0A%0AThe%20sanitizer%20removes%20or%20escapes%20unsafe%20HTML%20%28like%20%60%3Cscript%3E%60%20tags%20and%20event%20handlers%29%20and%20only%20allows%20a%20very%20limited%20set%20of%20safe%20tags.%20There%20is%20currently%20no%20supported%20way%20to%20allow%20arbitrary%20HTML%20in%20deck.gl%20tooltips%2C%20even%20with%20JS%20tooltip%20generators%2C%20unless%20you%20modify%20the%20code%20or%20the%20sanitizer%20configuration.%20This%20is%20a%20deliberate%20security%20measure%20in%20recent%20Superset%20versions.) [](https://go.dosu.dev/discord-bot) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/issues/36779)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Deck.gl polygon error [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
dosubot[bot] commented on issue #36779:
URL: https://github.com/apache/superset/issues/36779#issuecomment-3678832784
<!-- Answer -->
In Superset 6.0, all HTML—including simple tags like <br/>—is stripped or escaped in deck.gl tooltips for security reasons. This is enforced by an HTML sanitizer that removes all tags, so even if you use the JavaScript tooltip generator, <br/> will not render as a line break but will appear as plain text. This is a deliberate security measure to prevent XSS and applies to all HTML tags in tooltips, not just complex or unsafe ones. There is currently no supported way to allow even simple HTML like <br/> in deck.gl tooltips, and this behavior is consistent across recent Superset versions [see details](https://github.com/apache/superset/pull/33791).
If you need line breaks, you can use plain text separators (like \n or |), but these will not render as actual line breaks in the tooltip. Only Table charts have an option to render HTML in cells; this does not apply to deck.gl charts [see discussion](https://github.com/apache/superset/discussions/35000).
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot).*
---
<sup>How did I do? [Good](https://app.dosu.dev/response-feedback/35377d10-7851-47ca-9634-6fb41df1610d?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/35377d10-7851-47ca-9634-6fb41df1610d?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/35377d10-7851-47ca-9634-6fb41df1610d?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/35377d10-7851-47ca-9634-6fb41df1610d?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/35377d10-7851-47ca-9634-6fb41df1610d?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/35377d10-7851-47ca-9634-6fb41df1610d?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/35377d10-7851-47ca-9634-6fb41df1610d?feedback_type=other)</sup>
[](https://app.dosu.dev/a28d3c7e-a9d3-459e-9fb6-3a6f9ff4f357/ask?utm_source=github) [](https://cursor.com/link/prompt?text=In%20Superset%206.0%2C%20all%20HTML%E2%80%94including%20simple%20tags%20like%20%3Cbr/%3E%E2%80%94is%20stripped%20or%20escaped%20in%20deck.gl%20tooltips%20for%20security%20reasons.%20This%20is%20enforced%20by%20an%20HTML%20sanitizer%20that%20removes%20all%20tags%2C%20so%20even%20if%20you%20use%20the%20JavaScript%20tooltip%20generator%2C%20%3Cbr/%3E%20will%20not%20render%20as%20a%20line%20break%20but%20will%20appear%20as%20plain%20text.%20This%20is%20a%20deliberate%20security%20measure%20to%20prevent%20XSS%20and%20applies%20to%20all%20HTML%20tags%20in%20tooltips%2C%20not%20just%20complex%20or%20unsafe%20ones.%20There%20is%20currently%20no%20supported%20way%20to%20allow%20even%20simple%20HTML%20like%20%3Cbr/%3E%20in%20deck.gl%20tooltips%2C%20and%20thi
s%20behavior%20is%20consistent%20across%20recent%20Superset%20versions%C2%A0%5Bsee%20details%5D%28https%3A//github.com/apache/superset/pull/33791%29.%0A%0AIf%20you%20need%20line%20breaks%2C%20you%20can%20use%20plain%20text%20separators%20%28like%20%5Cn%20or%20%7C%29%2C%20but%20these%20will%20not%20render%20as%20actual%20line%20breaks%20in%20the%20tooltip.%20Only%20Table%20charts%20have%20an%20option%20to%20render%20HTML%20in%20cells%3B%20this%20does%20not%20apply%20to%20deck.gl%20charts%C2%A0%5Bsee%20discussion%5D%28https%3A//github.com/apache/superset/discussions/35000%29.) [](https://go.dosu.dev/discord-bot) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/issues/36779)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Deck.gl polygon error [superset]
Posted by "zufolo441 (via GitHub)" <gi...@apache.org>.
zufolo441 commented on issue #36779:
URL: https://github.com/apache/superset/issues/36779#issuecomment-3678831675
My HTML is simple <br/>, but they are escaped.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org