You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "timfursov (via GitHub)" <gi...@apache.org> on 2025/05/17 01:15:37 UTC
[I] Bad request instead of an actual error if error message contains http tags [superset]
timfursov opened a new issue, #33500:
URL: https://github.com/apache/superset/issues/33500
### Bug description
When creating a chart, if error massage contains html tag, `Unexpected error Bad request` is shown instead of an actual error.
However `api/v1/chart/data` responds with the full error text in `message` which makes me think that it has something to do with the ui trying to prevent XSS attacks.
I tried to play with `HTML_SANITIZATION` but it seems that nothing changes.
**How to reproduce**
1. Create a new chart
2. Create a custom metric with `<a>` in the expression
3. Press "UPDATE CHART"
4. If your db connector usually displays problematic query in the message error, instead of an actual error `Unexpected error Bad request` will be shown.
**Expected result**
`Unexpected error` and an actual error message returned by api in response like below
```
Unexpected error
Error: HTTPDriver for [your clickhouse host] received ClickHouse error code 62
Code: 62. DB::Exception: Syntax error: failed at position 37 ('<') (line 1, col 37): <a> AS `My column_b77020`
FROM (select number from numbers(10)
) AS `virtual_table`
LIMIT 1000
FORMAT Native. Expected one of: expression with optional alias, element of expression with optional alias, lambda expression, CAST operator, NOT, INTERVAL, CASE, DATE, TIMESTAMP, tuple, collection of literals, array, number, literal, NULL, NULL, Bool, TRUE, FALSE, string literal, asterisk, qualified asterisk, compound identifier, identifier, COLUMNS matcher, COLUMNS, qualified COLUMNS matcher, function name, substitution, MySQL-style global variable, end of query. (SYNTAX_ERROR) (version [your clickhouse version] (official build))
```
### Screenshots/recordings
<img width="1666" alt="Image" src="https://github.com/user-attachments/assets/396f5cf2-2291-4143-a2c5-50e56c67eedc" />
### Superset version
master / latest-dev
### Python version
3.10
### Node version
18 or greater
### Browser
Chrome
### Additional context
_No response_
### Checklist
- [ ] I have searched Superset docs and Slack and didn't find a solution to my problem.
- [x] I have searched the GitHub issue tracker and didn't find a similar bug report.
- [ ] I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Bad request instead of an actual error if error message contains html tags [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on issue #33500:
URL: https://github.com/apache/superset/issues/33500#issuecomment-4035385644
This is a valid API bug β when an error message contains HTML tags, the response becomes a 400 Bad Request instead of returning the actual error. A fix would involve sanitizing or escaping HTML in error messages before returning them in the API response. PRs welcome.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Bad request instead of an actual error if error message contains http tags [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
dosubot[bot] commented on issue #33500:
URL: https://github.com/apache/superset/issues/33500#issuecomment-2887926880
<!-- Greeting -->
Hello @timfursov! I'm [Dosu](https://dosu.dev), your friendly bot here to help you tackle bugs, answer questions, and explore contributions while you wait for a human maintainer. Letβs get this sorted out! π
<!-- Answer -->
To address the issue where an error message containing HTML tags results in "Unexpected error Bad request" instead of displaying the actual error message in Apache Superset, you can follow these steps:
1. **Use the ErrorBoundary Component**: Ensure your chart component is wrapped with the `ErrorBoundary` component. This component is designed to catch errors and handle them gracefully.
2. **Set the showMessage Prop**: Configure the `ErrorBoundary` component with the `showMessage` prop set to `true`. This ensures that error messages are displayed.
3. **Custom Error Handling**: Implement a custom `onError` function within the `ErrorBoundary` to log errors or perform additional handling as needed.
4. **Parse Error Messages Correctly**: Verify that the error parsing logic in `getClientErrorObject` correctly handles HTML content. The function `parseErrorJson` checks for HTML in error messages and retrieves the appropriate message using `retrieveErrorMessage`. Ensure this logic is correctly implemented and tested.
5. **Test Error Handling**: Make sure your error handling logic is thoroughly tested, as demonstrated in the `ErrorBoundary.test.tsx` file. This includes verifying that the error message is displayed when `showMessage` is set to `true` <sup>[[1]](https://github.com/apache/superset/blob/master/superset-frontend/packages/superset-ui-core/test/query/getClientErrorObject.test.ts)</sup><sup>[[2]](https://github.com/apache/superset/blob/master/superset-frontend/src/components/ErrorMessage/ErrorMessageWithStackTrace.tsx)</sup><sup>[[3]](https://github.com/apache/superset/blob/master/superset-frontend/src/components/ErrorBoundary/ErrorBoundary.test.tsx)</sup><sup>[[4]](https://github.com/apache/superset/blob/master/superset-frontend/packages/superset-ui-core/src/query/getClientErrorObject.ts)</sup>.
By following these steps, you can ensure that error messages, including those with HTML tags, are displayed correctly and informatively, rather than defaulting to a generic "Unexpected error Bad request".
<!-- Dosu Comment Footer -->
*To continue talking to [Dosu](https://dosu.dev), mention @dosu.*
---
<sup>Help Dosu learn! Give it feedback: [Great Response](https://app.dosu.dev/response-feedback/25d008e4-1d7e-4bbf-8571-28ea647e95f6?feedback_type=great_response) | [Irrelevant Answer](https://app.dosu.dev/response-feedback/25d008e4-1d7e-4bbf-8571-28ea647e95f6?feedback_type=irrelevant_answer) | [Incorrect Sources](https://app.dosu.dev/response-feedback/25d008e4-1d7e-4bbf-8571-28ea647e95f6?feedback_type=incorrect_sources) | [Too Verbose](https://app.dosu.dev/response-feedback/25d008e4-1d7e-4bbf-8571-28ea647e95f6?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/25d008e4-1d7e-4bbf-8571-28ea647e95f6?feedback_type=hallucination) | [Bug Report](https://app.dosu.dev/response-feedback/25d008e4-1d7e-4bbf-8571-28ea647e95f6?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/25d008e4-1d7e-4bbf-8571-28ea647e95f6?feedback_type=other)</sup>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Bad request instead of an actual error if error message contains html tags [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas closed issue #33500: Bad request instead of an actual error if error message contains html tags
URL: https://github.com/apache/superset/issues/33500
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Bad request instead of an actual error if error message contains html tags [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on issue #33500:
URL: https://github.com/apache/superset/issues/33500#issuecomment-5447938265
Tracking via #42489 β the fix is close but there's still a real edge case open in review (a message that itself starts with a quoted tag). No action needed here until that lands, but additional eyes/reviews/testing are always welcome.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org