You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "rusackas (via GitHub)" <gi...@apache.org> on 2026/06/01 22:26:26 UTC
[PR] fix(embedded-sdk): validate embedded dashboard id format before use [superset]
rusackas opened a new pull request, #40592:
URL: https://github.com/apache/superset/pull/40592
### SUMMARY
Adds defense-in-depth input validation for the embedded dashboard `id` in the embedded SDK before it is used to construct the iframe URL.
The `id` passed to `embedDashboard` is the UUID generated by Superset's embed configuration UI (hexadecimal characters and hyphens). A new exported helper, `validateEmbeddedDashboardId`, verifies that the `id` matches that expected format and throws otherwise. It is called as the first step of `embedDashboard`, before the value is interpolated into the iframe `src`.
This is a minor behavior change: a malformed `id` now throws `Error('Invalid dashboard id format')` instead of being used as-is. Well-formed UUIDs (the only values Superset produces) are unaffected.
Changes:
- Export `validateEmbeddedDashboardId(id)` and invoke it at the start of `embedDashboard`.
- Add a JSDoc note to the `id` prop documenting the expected format.
- Add `src/index.test.ts` covering the helper with valid and invalid inputs.
- Add `jest.config.js` with a `transformIgnorePatterns` entry so the `@superset-ui/switchboard` ES module is transformed when importing from `./index` in tests.
### TESTING INSTRUCTIONS
From `superset-embedded-sdk/`:
```bash
npm ci
npm test # unit tests, including validateEmbeddedDashboardId
npm run build # tsc + babel + webpack
```
All tests pass and the build succeeds locally. The new test asserts that canonical UUIDs and simple hex ids are accepted, and that ids containing unexpected characters (e.g. slashes, query/fragment markers, whitespace, empty string) throw.
### ADDITIONAL INFORMATION
- [ ] Has associated issue:
- [ ] Required feature flags:
- [ ] Changes UI
- [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351))
- [ ] Introduces new feature or API
- [ ] Removes existing feature or API
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(embedded-sdk): validate embedDashboard params (id, supersetDomain, sandbox) [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #40592:
URL: https://github.com/apache/superset/pull/40592#issuecomment-4597949597
AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
<details>
<summary>
Bito Usage Guide
</summary>
**Commands**
Type the following command in the pull request comment and save the comment.
- `/review` - Manually triggers a full AI review.
- `/pause` - Pauses automatic reviews on this pull request.
- `/resume` - Resumes automatic reviews.
- `/resolve` - Marks all Bito-posted review comments as resolved.
- `/abort` - Cancels all in-progress reviews.
Refer to the <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/available-commands" target="_blank" rel="noopener noreferrer">documentation</a> for additional commands.
**Configuration**
This repository uses `Superset` You can customize the agent settings <a href="https://alpha.bito.ai/home/ai-agents/code-review-agent" target="_blank" rel="noopener noreferrer">here</a> or contact your Bito workspace admin at evan@preset.io.
**Documentation & Help**
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/getting-started/install-run-using-bito-cloud/create-or-customize-an-agent-instance" target="_blank" rel="noopener noreferrer">Customize agent settings</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/implementing-custom-code-review-rules" target="_blank" rel="noopener noreferrer">Review rules</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent" target="_blank" rel="noopener noreferrer">General documentation</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/faqs" target="_blank" rel="noopener noreferrer">FAQ</a>
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(embedded-sdk): validate embedded dashboard id format before use [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #40592:
URL: https://github.com/apache/superset/pull/40592#issuecomment-4596999229
AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(embedded-sdk): validate embedded dashboard id format before use [superset]
Posted by "netlify[bot] (via GitHub)" <gi...@apache.org>.
netlify[bot] commented on PR #40592:
URL: https://github.com/apache/superset/pull/40592#issuecomment-4597013844
### <span aria-hidden="true">✅</span> Deploy Preview for *superset-docs-preview* ready!
| Name | Link |
|:-:|------------------------|
|<span aria-hidden="true">🔨</span> Latest commit | 4f2fe420444220b0dd316aee91d652e144786f31 |
|<span aria-hidden="true">🔍</span> Latest deploy log | https://app.netlify.com/projects/superset-docs-preview/deploys/6a1e07114f81b200071af242 |
|<span aria-hidden="true">😎</span> Deploy Preview | [https://deploy-preview-40592--superset-docs-preview.netlify.app](https://deploy-preview-40592--superset-docs-preview.netlify.app) |
|<span aria-hidden="true">📱</span> Preview on mobile | <details><summary> Toggle QR Code... </summary><br /><br /><br /><br />_Use your smartphone camera to open QR code link._</details> |
|<span aria-hidden="true">🤖</span> Make changes | [Run an agent on this branch](https://app.netlify.com/projects/superset-docs-preview/agent-runs#DctBCoAgEADAv-w5SUUq-kHPWNuVJE0xiSL6e97mMi_kkmKuMAN0YAse69bs_N1ztEzEJE7ahSfhUolYxYXBE1afjhaIc0jPQq0MqFiOShk3KaulbEanjYbvBw) |
---
<!-- [superset-docs-preview Preview](https://deploy-preview-40592--superset-docs-preview.netlify.app) -->
_To edit notification comments on pull requests, go to your [Netlify project configuration](https://app.netlify.com/projects/superset-docs-preview/configuration/notifications#deploy-notifications)._
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(embedded-sdk): validate embedDashboard params (id, supersetDomain, sandbox) [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas closed pull request #40592: fix(embedded-sdk): validate embedDashboard params (id, supersetDomain, sandbox)
URL: https://github.com/apache/superset/pull/40592
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org