rusackas opened a new pull request, #40645:
URL: https://github.com/apache/superset/pull/40645
### SUMMARY
Three small correctness/hardening fixes across the email, logs, and CSV
export layers:
1. **Email subject CRLF stripping** (`superset/utils/core.py`,
`send_email_smtp`): the subject was assigned to `msg["Subject"]` verbatim.
CR/LF characters are now stripped (`\r` removed, `\n` collapsed to a space,
then trimmed) before setting the header, so the subject value cannot fold or
split into additional email headers.
2. **UTC log pruning** (`superset/commands/logs/prune.py`): the retention
cutoff used a timezone-naive `datetime.now()`. It now uses
`datetime.now(tz=timezone.utc)` so retention matches how `Log.dttm` is stored
(UTC) and stays correct regardless of the server's local timezone.
3. **CSV formula-prefix escaping on export** (`superset/utils/csv.py`):
formula-prefix escaping already existed (`escape_value` / `df_to_escaped_csv`,
wired into `viz.py`, `query_context_processor.py`, and `sql_lab/export.py`).
The existing matcher covered `-`, `@`, `+`, `|`, `=`, `%`. It is extended to
also treat a leading tab or carriage return as dangerous, since some
spreadsheet software trims that leading whitespace and then evaluates the
remainder. Numeric columns remain untouched (only string/object cells are
escaped).
### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
N/A
### TESTING INSTRUCTIONS
Unit tests added/updated:
-
`tests/unit_tests/utils/test_core.py::test_send_email_smtp_strips_crlf_from_subject`
— CR/LF stripped from subject.
-
`tests/unit_tests/commands/logs/prune_test.py::test_prune_cutoff_is_tz_aware_utc`
— prune cutoff is timezone-aware UTC.
- `tests/unit_tests/utils/csv_tests.py` — `escape_value` escapes leading
tab/CR; `df_to_escaped_csv` escapes `=cmd()` while leaving numeric columns
untouched.
Run:
```
python -m pytest tests/unit_tests/utils/csv_tests.py \
tests/unit_tests/commands/logs/prune_test.py \
tests/unit_tests/utils/test_core.py::test_send_email_smtp_strips_crlf_from_subject
-q
```
All pass. `ruff check` clean on changed files.
### ADDITIONAL INFORMATION
- [ ] Has associated issue:
- [ ] Required feature flags:
- [ ] Changes UI
- [ ] Includes DB Migration (follow approval process in
[SIP-59](https://github.com/apache/superset/issues/13351))
- [ ] Migration is atomic, supports rollback & is backwards-compatible
- [ ] Confirm DB migration upgrade and downgrade tested
- [ ] Runtime estimates and downtime expectations provided
- [ ] Introduces new feature or API
- [ ] Removes existing feature or API
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
