You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "aho-exerp (via GitHub)" <gi...@apache.org> on 2023/12/07 14:39:22 UTC
[I] Custom delimiter configuration isn't loaded for CSV import [superset]
aho-exerp opened a new issue, #26209:
URL: https://github.com/apache/superset/issues/26209
On 'CSV to Database configuration' the field for custom delimiter configuration isn't loaded when choosing 'Other' - due to violation of Content Security Policy (CSP) by static nonce on script. The issue isn't present the first time the page is loaded, but upon every following visit to the page.
#### How to reproduce the bug
1. Leave Superset with default TALISMAN configuration
2. Add database connection and under 'Advances'->'Security' check 'Allow file uploads to database'
3. In browser open development tools, so you can see the source HTML
4. Go to 'Data' -> 'Upload CSV to database'
5. Select on Delimiter: 'Other'
6. If you are opening this page first time, reload the page to see the error
### Expected results
A free text input field under 'Enter a delimiter for this data' is loaded. No CSP errors.
### Actual results
No text input field is loaded, instead in the Dev console of the browser you can see the following error:
`Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' 'strict-dynamic' 'nonce-A3G08VMJ0tosJ5Wlse9kLCHiqfipHohf'". Either the 'unsafe-inline' keyword, a hash ('sha256-LDZ4ztcGb3PpryC0w3Ox6TyZleJKsSIt1Vu4Zay22rE='), or a nonce ('nonce-...') is required to enable inline execution.`
#### Screenshots
In the html script one can see that the nonce set on the script handling the delimiter does not refresh along with the other nonces on the page when the page is refreshed but instead stays static.
### Environment
(please complete the following information):
- browser type and version: Chrome 119.0.6045.200
- superset version: 3.0.1
- python version: 3.9.18
- node.js version: `node -v`
- any feature flags active:{
"ALLOW_DASHBOARD_DOMAIN_SHARDING": true,
"CLIENT_CACHE": false,
"DISABLE_DATASET_SOURCE_EDIT": false,
"DYNAMIC_PLUGINS": false,
"ENABLE_EXPLORE_JSON_CSRF_PROTECTION": false,
"ENABLE_TEMPLATE_PROCESSING": false,
"KV_STORE": false,
"PRESTO_EXPAND_DATA": false,
"THUMBNAILS": false,
"DASHBOARD_CACHE": false,
"REMOVE_SLICE_LEVEL_LABEL_COLORS": false,
"SHARE_QUERIES_VIA_KV_STORE": false,
"SIP_38_VIZ_REARCHITECTURE": false,
"TAGGING_SYSTEM": false,
"SQLLAB_BACKEND_PERSISTENCE": false,
"LISTVIEWS_DEFAULT_CARD_VIEW": false,
"DRILL_TO_DETAIL": true,
"ENABLE_REACT_CRUD_VIEWS": true,
"DISPLAY_MARKDOWN_HTML": true,
"ESCAPE_MARKDOWN_HTML": false,
"DASHBOARD_NATIVE_FILTERS": true,
"GLOBAL_ASYNC_QUERIES": false,
"VERSIONED_EXPORT": true,
"ROW_LEVEL_SECURITY": false,
"ALERT_REPORTS": true
}
### Checklist
Make sure to follow these steps before submitting your issue - thank you!
- [x] I have checked the superset logs for python stacktraces and included it here as text if there are any.
- [x] I have reproduced the issue with at least the latest released version of superset.
- [x] I have checked the issue tracker for the same issue and I haven't found one similar.
### Additional context
Add any other context about the problem here.
- Using TALISMAN_ENABLED = False negates the issue.
- Opening the page in another browser or incognito mode shows that the element presents the same static nonce.
- Adding 'unsafe-inline' to 'script-src' isn't a solution as it is ignored due to the nonce being present.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Custom delimiter configuration isn't loaded for CSV import [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on issue #26209:
URL: https://github.com/apache/superset/issues/26209#issuecomment-4043503165
It seems the original issue — the custom delimiter field not appearing due to a CSP nonce violation — has been addressed by the CSV import UI redesign in 4.1.x, which now offers a dropdown of common delimiters (including `;`) rather than a free-text custom input.
If you still need a delimiter that isn't in the current list, it might be worth opening a new issue or discussion to request adding it.
@deuspt — the quoting/escaping issue you described (comma-separated values with quoted fields not parsing correctly) sounds like a separate bug. It would be great if you could open a new issue specifically for that with a minimal CSV example, as it's a different root cause and deserves its own tracking. Last activity on this issue was approximately 6 months ago — closing as the original problem appears to be resolved.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Custom delimiter configuration isn't loaded for CSV import [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas closed issue #26209: Custom delimiter configuration isn't loaded for CSV import
URL: https://github.com/apache/superset/issues/26209
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Custom delimiter configuration isn't loaded for CSV import [superset]
Posted by "xavier-GitHub76 (via GitHub)" <gi...@apache.org>.
xavier-GitHub76 commented on issue #26209:
URL: https://github.com/apache/superset/issues/26209#issuecomment-2841487020
With Superset 4.1.2 (and 5.0.0-RC2), the import screen is different.
Delimiter is definied with :
Entering a custom delimiter is therefore no longer possible
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Custom delimiter configuration isn't loaded for CSV import [superset]
Posted by "xavier-GitHub76 (via GitHub)" <gi...@apache.org>.
xavier-GitHub76 commented on issue #26209:
URL: https://github.com/apache/superset/issues/26209#issuecomment-3257300316
For my part, the proposed delimiters suit me.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Custom delimiter configuration isn't loaded for CSV import [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on issue #26209:
URL: https://github.com/apache/superset/issues/26209#issuecomment-3254652725
Does the feature work as designed? Are you trying to use some other delimiter? Curious the use case... maybe we can add more of them to the list.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Custom delimiter configuration isn't loaded for CSV import [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on issue #26209:
URL: https://github.com/apache/superset/issues/26209#issuecomment-2065424736
I assume you're still facing this in Superset 3.1 / 4.x as we haven't changed much in Talisman configs.
Are you able to add `unsafe-inline` to `script-src` to work around this? CC @michael-s-molina @kgabryje who might know more about the nonce implementation.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Custom delimiter configuration isn't loaded for CSV import [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on issue #26209:
URL: https://github.com/apache/superset/issues/26209#issuecomment-2802627440
Is this still the case in 4.1.2? Anyone want to open a PR adjusting the CSPs?
This is otherwise at risk of being closed as stale (it hasn't been touched in around 200 days) / not-planned (we intend to convert this view to React at some point, and can likely address it then).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Custom delimiter configuration isn't loaded for CSV import [superset]
Posted by "deuspt (via GitHub)" <gi...@apache.org>.
deuspt commented on issue #26209:
URL: https://github.com/apache/superset/issues/26209#issuecomment-3283454165
I am seeing a somewhat related issue on v4.1.3, using the Delimiter Comma "," on the upload modal.
When uploading a csv file where some lines enclose some text containing the comma delimiter (,) inside quotes, it ends up not parsing the line into multiple columns:
- rows with quotes → is treating the entire line as one column (goes into column #1, all the others are null).
e.g. aaaa,bbbb,"xx,yy",dddd
- rows without quotes → splits correctly on commas.
e.g. aaaa,bbbb,cccc,dddd
Is the quotechar " unsupported at the moment?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Custom delimiter configuration isn't loaded for CSV import [superset]
Posted by "aho-exerp (via GitHub)" <gi...@apache.org>.
aho-exerp commented on issue #26209:
URL: https://github.com/apache/superset/issues/26209#issuecomment-3258309433
In my case the ';' option was missing before and that's why the issue with the custom option not working became a problem
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org