[GitHub] [superset] kgabryje commented on a diff in pull request #24262: chore: Enable CSP by default

["kgabryje (via GitHub)" <gi...@apache.org>]

kgabryje commented on code in PR #24262:
URL: https://github.com/apache/superset/pull/24262#discussion_r1213037154


##########
superset-frontend/packages/superset-ui-core/src/models/ExtensibleFunction.ts:
##########
@@ -22,9 +22,8 @@
  */
 
 export default class ExtensibleFunction extends Function {
+  // @ts-ignore
   constructor(fn: Function) {
-    super();

Review Comment:
   Calling `new Function()` breaks the CSP rule that disallows using `eval` in scripts.
   Extending `Function` is a nice hack that let's us make a class instance (in most cases it's a formatter) callable - for example instead of calling `formatter.format(value)` we call `formatter(value)`. Removing `super()` does not break that behaviour while also letting us avoid calling Function constructor.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org