justinpark opened a new pull request, #37868:
URL: https://github.com/apache/superset/pull/37868
### SUMMARY
This commit introduces a echart option editor on basic echart types (i.e.
area, bar, line, smoothline, and multi-timeseries).
This commit also introduces a secure parsing mechanism for custom EChart
options, replacing the unsafe new Function() pattern with an AST-based parser.
This addresses a critical security vulnerability where arbitrary JavaScript
code could be executed through the EChart options input.
Key Changes:
1. Secure AST-based Parser (safeEchartOptionsParser.ts)
- Uses acorn for parsing JavaScript object literals into an Abstract
Syntax Tree
- Validates that only safe constructs are used (no function
declarations, arrow functions, or identifiers that could execute code)
- Provides detailed error messages with line/column locations for syntax
errors
2. Zod Schema Validation (echartOptionsSchema.ts)
- Comprehensive Zod schemas for all EChart option types (title, legend,
grid, axis, tooltip, dataZoom, toolbox, visualMap, series, graphic, axisPointer)
- Type-safe validation with TypeScript type inference
- Partial validation pattern - validates each property individually to
provide granular error feedback
3. Custom Error Class (EChartOptionsParseError)
- Structured error handling with errorType ('parse_error' |
'security_error' | 'validation_error')
- Collects all validation errors in validationErrors array
- Includes source location information for debugging
4. JSEditorControl Component
- New control component for editing EChart options
- Real-time validation with error display
- Debounced input to avoid excessive validation calls
5. Integration with transformProps.ts
- Updated to use safeParseEChartOptions with proper error handling
### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
After:
<img width="520" height="1009" alt="Screenshot 2026-02-10 at 4 27 43 PM"
src="https://github.com/user-attachments/assets/cbe54e3d-5d6a-40a7-ad17-55e9e096f059";
/>
After(on error):
<img width="344" height="382" alt="Screenshot 2026-02-10 at 4 16 40 PM"
src="https://github.com/user-attachments/assets/a2b852f9-6d1f-441e-802a-c5eb6f63e9a6";
/>
### TESTING INSTRUCTIONS
Create a (echart-based) chart and then set a config by echart option editor
### ADDITIONAL INFORMATION
<!--- Check any relevant boxes with "x" -->
<!--- HINT: Include "Fixes #nnn" if you are fixing an existing issue -->
- [ ] Has associated issue:
- [ ] Required feature flags:
- [ ] Changes UI
- [ ] Includes DB Migration (follow approval process in
[SIP-59](https://github.com/apache/superset/issues/13351))
- [ ] Migration is atomic, supports rollback & is backwards-compatible
- [ ] Confirm DB migration upgrade and downgrade tested
- [ ] Runtime estimates and downtime expectations provided
- [ ] Introduces new feature or API
- [ ] Removes existing feature or API
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
