Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: dataset safe URL for explore_url #24686

Merged
merged 10 commits into from
Aug 23, 2023
Merged
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
improve code
dpgaspar committed Jul 13, 2023
commit f4e016768a3836b5dc04f3bf769188a164978089
2 changes: 1 addition & 1 deletion superset-frontend/src/pages/DatasetList/index.tsx
Original file line number Diff line number Diff line change
@@ -182,7 +182,7 @@ const DatasetList: FunctionComponent<DatasetListProps> = ({
setSSHTunnelPrivateKeyPasswordFields,
] = useState<string[]>([]);

const PREVENT_UNSAFE_DEFAULT_URLS_ON_DATASET: boolean = useSelector<
const PREVENT_UNSAFE_DEFAULT_URLS_ON_DATASET = useSelector<
any,
boolean
>(
26 changes: 0 additions & 26 deletions tests/integration_tests/datasets/api_tests.py
Original file line number Diff line number Diff line change
@@ -1416,32 +1416,6 @@ def test_update_dataset_item_uniqueness(self):
db.session.delete(ab_user)
db.session.commit()

def test_update_dataset_unsafe_default_endpoint(self):
"""
Dataset API: Test unsafe default endpoint
"""
if backend() == "sqlite":
return

dataset = self.insert_default_dataset()
self.login(username="admin")
uri = f"api/v1/dataset/{dataset.id}"
table_data = {"default_endpoint": "http://www.google.com"}
rv = self.client.put(uri, json=table_data)
data = json.loads(rv.data.decode("utf-8"))
assert rv.status_code == 422
expected_response = {
"message": {
"default_endpoint": [
"The submitted URL is not considered safe,"
" only use URLs with the same domain as Superset."
]
}
}
assert data == expected_response
db.session.delete(dataset)
db.session.commit()

@patch("superset.daos.dataset.DatasetDAO.update")
def test_update_dataset_sqlalchemy_error(self, mock_dao_update):
"""