sadpandajoe commented on code in PR #39925:
URL: https://github.com/apache/superset/pull/39925#discussion_r3335833468
##########
superset-frontend/src/explore/components/controls/AnnotationLayerControl/AnnotationLayer.tsx:
##########
@@ -145,7 +146,7 @@
<span>
{t('Add an annotation layer')}{' '}
<a
- href="/annotationlayer/list"
+ href={ensureAppRoot('/annotationlayer/list')}
Review Comment:
Stale: the original `<AppLink>` callsite this alert covered was reverted in
5fee21b509 back to `<a href={ensureAppRoot('/annotationlayer/list')}>`.
`ensureAppRoot` returns a router-relative path from a string-literal input
('/annotationlayer/list' has no dynamic taint), and the value is then assigned
to an anchor `href` (not a `window.location` sink), so the data-flow source
CodeQL was tracking no longer reaches a flagged sink. Closing.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
