bito-code-review[bot] commented on code in PR #36933: URL: https://github.com/apache/superset/pull/36933#discussion_r2932133595
########## superset/mcp_service/embedded_chart/schemas.py: ########## @@ -0,0 +1,101 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +from datetime import datetime +from typing import Any + +from pydantic import BaseModel, Field + +# Import the same ChartConfig used by generate_chart +from superset.mcp_service.chart.schemas import ChartConfig + + +class GetEmbeddableChartRequest(BaseModel): + """Request schema for get_embeddable_chart tool. + + Uses the same simplified ChartConfig schema as generate_chart for consistency. + """ + + datasource_id: int | str = Field( + ..., + description="Dataset ID (numeric) or UUID", + ) + config: ChartConfig = Field( + ..., + description=( + "Chart configuration using simplified schema. Use chart_type='xy' for " + "line/bar/area/scatter charts, or chart_type='table' for tables. " + 'Example: {"chart_type": "xy", "x": {"name": "genre"}, ' + '"y": [{"name": "sales", "aggregate": "SUM"}], "kind": "bar"}' + ), + ) + ttl_minutes: int = Field( + default=60, + ge=1, + le=10080, # max 1 week + description="Permalink TTL in minutes (default: 60, max: 10080 = 1 week)", + ) + height: int = Field( + default=400, + ge=100, + le=2000, + description="Chart height in pixels for iframe (default: 400)", + ) + rls_rules: list[dict[str, Any]] = Field( + default_factory=list, + description="Row-level security rules to apply to the guest token", + ) + allowed_domains: list[str] = Field( Review Comment: <div> <div id="suggestion"> <div id="issue"><b>Missing URL validation</b></div> <div id="fix"> The allowed_domains field accepts any strings, but for security in embedding, it should validate that inputs are valid HTTP URLs. Using pydantic's HttpUrl type would prevent invalid domains from being accepted. </div> <details> <summary> <b>Code suggestion</b> </summary> <blockquote>Check the AI-generated fix before applying</blockquote> <div id="code"> ``` - from pydantic import BaseModel, Field + from pydantic import BaseModel, Field, HttpUrl @@ -57,12 +57,12 @@ - rls_rules: list[dict[str, Any]] = Field( - default_factory=list, - description="Row-level security rules to apply to the guest token", - ) - allowed_domains: list[str] = Field( - default_factory=list, - description=( - "List of domains allowed to embed this chart. " - "If empty, any domain can embed (less secure). " - "Example: ['https://example.com', 'https://app.example.com']" - ), - ) + rls_rules: list[dict[str, Any]] = Field( + default_factory=list, + description="Row-level security rules to apply to the guest token", - ) + allowed_domains: list[HttpUrl] = Field( + default_factory=list, + description=( + "List of domains allowed to embed this chart. " + "If empty, any domain can embed (less secure). " + "Example: ['https://example.com', 'https://app.example.com']" - ), - ) ``` </div> </details> </div> <small><i>Code Review Run #1ea619</i></small> </div> --- Should Bito avoid suggestions like this for future reviews? (<a href=https://alpha.bito.ai/home/ai-agents/review-rules>Manage Rules</a>) - [ ] Yes, avoid them ########## superset/embedded_chart/view.py: ########## @@ -0,0 +1,139 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +import logging +from typing import Callable +from urllib.parse import urlparse + +from flask import abort, current_app, request +from flask_appbuilder import expose +from flask_login import AnonymousUserMixin, current_user, login_user + +from superset import event_logger +from superset.daos.key_value import KeyValueDAO +from superset.explore.permalink.schemas import ExplorePermalinkSchema +from superset.key_value.exceptions import KeyValueParseKeyError +from superset.key_value.shared_entries import get_permalink_salt +from superset.key_value.types import ( + KeyValueResource, + MarshmallowKeyValueCodec, + SharedKey, +) +from superset.key_value.utils import decode_permalink_id +from superset.superset_typing import FlaskResponse +from superset.utils import json +from superset.views.base import BaseSupersetView, common_bootstrap_payload + +logger = logging.getLogger(__name__) + + +def same_origin(url1: str | None, url2: str | None) -> bool: + """Check if two URLs have the same origin (scheme + netloc).""" + if not url1 or not url2: + return False + parsed1 = urlparse(url1) + parsed2 = urlparse(url2) + # For domain matching, we just check if the host matches + # url2 might just be a domain like "example.com" + if not parsed2.scheme or (not parsed2.netloc and ":" in url2): + # url2 is a bare domain or host:port (e.g., "localhost:3000"), + # which urlparse misinterprets. Compare directly with netloc. + return parsed1.netloc == url2 or parsed1.netloc.endswith(f".{url2}") + return (parsed1.scheme, parsed1.netloc) == (parsed2.scheme, parsed2.netloc) + + +class EmbeddedChartView(BaseSupersetView): + """Server-side rendering for embedded chart pages.""" + + route_base = "/embedded/chart" + + @expose("/") + @event_logger.log_this_with_extra_payload + def embedded_chart( + self, + add_extra_log_payload: Callable[..., None] = lambda **kwargs: None, + ) -> FlaskResponse: + """ + Server side rendering for the embedded chart page. + Expects ?permalink_key=xxx query parameter. + """ + # Get permalink_key from query params + permalink_key = request.args.get("permalink_key") + if not permalink_key: + logger.warning("Missing permalink_key in embedded chart request") + abort(404) + + # Get permalink value to check allowed domains + try: + salt = get_permalink_salt(SharedKey.EXPLORE_PERMALINK_SALT) + codec = MarshmallowKeyValueCodec(ExplorePermalinkSchema()) + key = decode_permalink_id(permalink_key, salt=salt) + permalink_value = KeyValueDAO.get_value( + KeyValueResource.EXPLORE_PERMALINK, + key, + codec, + ) + except (ValueError, KeyError, KeyValueParseKeyError) as ex: + logger.warning("Error fetching permalink for referrer validation: %s", ex) + permalink_value = None + Review Comment: <div> <div id="suggestion"> <div id="issue"><b>Security: Invalid permalink bypasses domain check</b></div> <div id="fix"> The code skips domain validation when permalink_value is None, creating a security vulnerability where invalid permalink keys allow unrestricted access to embedded charts. Add a check to abort with 404 for invalid permalinks, consistent with how invalid embedded objects are handled elsewhere. </div> <details> <summary> <b>Code suggestion</b> </summary> <blockquote>Check the AI-generated fix before applying</blockquote> <div id="code"> ````suggestion permalink_value = None # Validate request referrer against allowed domains (if configured) if not permalink_value: abort(404) # Validate request referrer against allowed domains (if configured) ```` </div> </details> </div> <small><i>Code Review Run #1ea619</i></small> </div> --- Should Bito avoid suggestions like this for future reviews? (<a href=https://alpha.bito.ai/home/ai-agents/review-rules>Manage Rules</a>) - [ ] Yes, avoid them -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
