[GitHub] [incubator-superset] mistercrunch opened a new issue #8107: Be more restrictive around `assets/static` in MANIFEST.in

[GitBox <gi...@apache.org>]

mistercrunch opened a new issue #8107: Be more restrictive around `assets/static` in MANIFEST.in
URL: https://github.com/apache/incubator-superset/issues/8107
 
 
   Currently in https://github.com/apache/incubator-superset/blob/master/MANIFEST.in we include all of `superset/static` which has a symlink to `superset/assets` and then exclude a set of things.
   
   Currently that means that lots of config files like `package-lock.json`, `package.json`, `.babelrc` and tons more stuff can be accessed in any given Superset instance and be leveraged to find vulnerabilities with something as simple as `npm audit`.
   
   We should have a much more whitelist approach and limit further what gets into the package. Include only `dist/` and `images/` by default and what's necessary for Superset to run.

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
users@infra.apache.org


With regards,
Apache Git Services

---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org