You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "kgabryje (via GitHub)" <gi...@apache.org> on 2023/06/21 16:18:39 UTC
[GitHub] [superset] kgabryje opened a new pull request, #24476: Revert "chore: Enable CSP by default (#24262)"
kgabryje opened a new pull request, #24476:
URL: https://github.com/apache/superset/pull/24476
### SUMMARY
This reverts commit c3b5d72f2b078eff4ff21213085f0d4ad6d282e9.
When `TALISMAN_ENABLED` ff is set to False, `csp_nonce` jinja function is undefined. Reverting until I fix this bug
### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
<!--- Skip this if not applicable -->
### TESTING INSTRUCTIONS
<!--- Required! What steps can be taken to manually verify the changes? -->
### ADDITIONAL INFORMATION
<!--- Check any relevant boxes with "x" -->
<!--- HINT: Include "Fixes #nnn" if you are fixing an existing issue -->
- [ ] Has associated issue:
- [ ] Required feature flags:
- [ ] Changes UI
- [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351))
- [ ] Migration is atomic, supports rollback & is backwards-compatible
- [ ] Confirm DB migration upgrade and downgrade tested
- [ ] Runtime estimates and downtime expectations provided
- [ ] Introduces new feature or API
- [ ] Removes existing feature or API
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [superset] codecov[bot] commented on pull request #24476: fix: Revert enabling CSP
Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #24476:
URL: https://github.com/apache/superset/pull/24476#issuecomment-1601156447
## [Codecov](https://app.codecov.io/gh/apache/superset/pull/24476?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
> Merging [#24476](https://app.codecov.io/gh/apache/superset/pull/24476?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) (716d6d6) into [master](https://app.codecov.io/gh/apache/superset/commit/d5f88c18f61cc919a8bdecfa92251d0d4d35abac?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) (d5f88c1) will **decrease** coverage by `10.99%`.
> The diff coverage is `100.00%`.
> :exclamation: Current head 716d6d6 differs from pull request most recent head f96e032. Consider uploading reports for the commit f96e032 to get more accurate results
```diff
@@ Coverage Diff @@
## master #24476 +/- ##
===========================================
- Coverage 69.03% 58.04% -10.99%
===========================================
Files 1901 1901
Lines 74002 74001 -1
Branches 8116 8116
===========================================
- Hits 51086 42953 -8133
- Misses 20805 28937 +8132
Partials 2111 2111
```
| Flag | Coverage Δ | |
|---|---|---|
| hive | `?` | |
| mysql | `?` | |
| postgres | `?` | |
| presto | `53.84% <100.00%> (+<0.01%)` | :arrow_up: |
| python | `60.63% <100.00%> (-22.87%)` | :arrow_down: |
| sqlite | `?` | |
| unit | `54.68% <100.00%> (+<0.01%)` | :arrow_up: |
Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#carryforward-flags-in-the-pull-request-comment) to find out more.
| [Impacted Files](https://app.codecov.io/gh/apache/superset/pull/24476?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [.../superset-ui-core/src/models/ExtensibleFunction.ts](https://app.codecov.io/gh/apache/superset/pull/24476?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-c3VwZXJzZXQtZnJvbnRlbmQvcGFja2FnZXMvc3VwZXJzZXQtdWktY29yZS9zcmMvbW9kZWxzL0V4dGVuc2libGVGdW5jdGlvbi50cw==) | `100.00% <ø> (ø)` | |
| [superset/config.py](https://app.codecov.io/gh/apache/superset/pull/24476?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-c3VwZXJzZXQvY29uZmlnLnB5) | `91.40% <100.00%> (-0.60%)` | :arrow_down: |
| [superset/initialization/\_\_init\_\_.py](https://app.codecov.io/gh/apache/superset/pull/24476?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-c3VwZXJzZXQvaW5pdGlhbGl6YXRpb24vX19pbml0X18ucHk=) | `91.38% <100.00%> (+0.30%)` | :arrow_up: |
... and [300 files with indirect coverage changes](https://app.codecov.io/gh/apache/superset/pull/24476/indirect-changes?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
:mega: We’re building smart automated test selection to slash your CI/CD build times. [Learn more](https://about.codecov.io/iterative-testing/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [superset] github-code-scanning[bot] commented on a diff in pull request #24476: fix: Revert enabling CSP
Posted by "github-code-scanning[bot] (via GitHub)" <gi...@apache.org>.
github-code-scanning[bot] commented on code in PR #24476:
URL: https://github.com/apache/superset/pull/24476#discussion_r1237276318
##########
superset/templates/superset/theme.html:
##########
@@ -1340,15 +1340,7 @@
{% endblock %}
{% block tail_js %}
{{ super() }}
- <script
- src="https://code.jquery.com/jquery-1.10.2.min.js"
- integrity="sha256-C6CB9UYIS9UJeqinPHWTHVqh/E1uhG5Twh+Y5qFQmYg="
- crossorigin="anonymous"
- nonce="{{ csp_nonce() }}"></script>
- <script
- src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js"
- integrity="sha384-Tc5IQib027qvyjSMfHjOMaLkfuWVxZxUPnCJA7l2mCWNIpG9mGCD8wGNIcPD7Txa"
- crossorigin="anonymous"
- nonce="{{ csp_nonce() }}"></script>
- <script src="{{ assets_prefix }}/static/assets/stylesheets/less/cosmo/cosmoTheme.js" nonce="{{ csp_nonce() }}"></script>
+ <script src="https://code.jquery.com/jquery-1.10.2.min.js"></script>
Review Comment:
## Inclusion of functionality from an untrusted source
Script loaded from content delivery network with no integrity check.
[Show more details](https://github.com/apache/superset/security/code-scanning/14)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [superset] kgabryje merged pull request #24476: fix: Revert enabling CSP
Posted by "kgabryje (via GitHub)" <gi...@apache.org>.
kgabryje merged PR #24476:
URL: https://github.com/apache/superset/pull/24476
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org