codeant-ai-for-open-source[bot] commented on code in PR #40327:
URL: https://github.com/apache/superset/pull/40327#discussion_r3279839273
##########
docker/docker-bootstrap.sh:
##########
@@ -80,7 +80,19 @@ case "${1}" in
;;
app)
echo "Starting web app (using development server)..."
- flask run -p $PORT --reload --debugger --host=0.0.0.0 --exclude-patterns
"*/node_modules/*:*/.venv/*:*/build/*:*/__pycache__/*:*/superset-frontend/*"
+
+ # Environment-based debugger control for security
+ # Only enable Werkzeug interactive debugger when explicitly requested
+ # Modern Werkzeug (3.0+) includes PIN protection, but defense-in-depth
approach
+ DEBUGGER_FLAG=""
+ if [[ "${SUPERSET_DEBUG_ENABLED:-}" == "true" ]]; then
+ DEBUGGER_FLAG="--debugger"
+ echo " ⚠️ Werkzeug debugger enabled (requires PIN for /console
access)"
+ else
+ echo " 🔒 Werkzeug debugger disabled (set SUPERSET_DEBUG_ENABLED=true
to enable)"
+ fi
+
+ flask run -p $PORT --reload $DEBUGGER_FLAG --host=0.0.0.0
--exclude-patterns
"*/node_modules/*:*/.venv/*:*/build/*:*/__pycache__/*:*/superset-frontend/*"
Review Comment:
**🟠 Architect Review — HIGH**
SUPERSET_DEBUG_ENABLED-based gating does not actually disable the Werkzeug
debugger by default: docker/.env and .flaskenv set FLASK_DEBUG=true and
docker-compose.yml loads docker/.env into the superset service, so even when
SUPERSET_DEBUG_ENABLED is unset the script prints "debugger disabled" while the
Flask/Werkzeug debugger (and /console) remain enabled via FLASK_DEBUG.
**Suggestion:** In the "disabled" branch, explicitly turn off the debugger
(for example by passing --no-debugger or overriding FLASK_DEBUG for this
command, or by making FLASK_DEBUG default to false in the Docker dev env) so
the effective debugger state matches the SUPERSET_DEBUG_ENABLED flag and the
startup message.
[Fix in
Cursor](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=542f807a23fd417cb8727b9e9e22870b&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
| [Fix in VSCode
Claude](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=542f807a23fd417cb8727b9e9e22870b&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
*(Use Cmd/Ctrl + Click for best experience)*
<details>
<summary><b>Prompt for AI Agent 🤖 </b></summary>
```mdx
This is an **Architect / Logical Review** comment left during a code review.
These reviews are first-class, important findings — not optional suggestions.
Do NOT dismiss this as a 'big architectural change' just because the title says
architect review; most of these can be resolved with a small, localized fix
once the intent is understood.
**Path:** docker/docker-bootstrap.sh
**Line:** 88:95
**Comment:**
*HIGH: SUPERSET_DEBUG_ENABLED-based gating does not actually disable
the Werkzeug debugger by default: docker/.env and .flaskenv set
FLASK_DEBUG=true and docker-compose.yml loads docker/.env into the superset
service, so even when SUPERSET_DEBUG_ENABLED is unset the script prints
"debugger disabled" while the Flask/Werkzeug debugger (and /console) remain
enabled via FLASK_DEBUG.
Validate the correctness of the flagged issue. If correct, How can I resolve
this? If you propose a fix, implement it and please make it concise.
If a suggested approach is provided above, use it as the authoritative
instruction. If no explicit code suggestion is given, you MUST still draft and
apply your own minimal, localized fix — do not punt back with 'no suggestion
provided, review manually'. Keep the change as small as possible: add a guard
clause, gate on a loading state, reorder an await, wrap in a conditional, etc.
Do not refactor surrounding code or expand scope beyond the finding.
Once fix is implemented, also check other comments on the same PR, and ask
user if the user wants to fix the rest of the comments as well. if said yes,
then fetch all the comments validate the correctness and implement a minimal fix
```
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
