bito-code-review[bot] commented on code in PR #40632:
URL: https://github.com/apache/superset/pull/40632#discussion_r3345944336
##########
superset/charts/data/api.py:
##########
@@ -616,6 +616,13 @@ def _get_data_response(
def _extract_export_params_from_request(self) -> tuple[str | None, int |
None]:
"""Extract filename and expected_rows from request for streaming
exports."""
filename = request.form.get("filename")
+ if filename:
+ # Sanitize the user-supplied filename before it is used in the
+ # Content-Disposition header (consistent with the generated-name
+ # path). secure_filename may reduce a name consisting entirely of
+ # unsupported characters to an empty string, in which case fall
back
+ # to the generated default downstream.
+ filename = secure_filename(filename) or None
Review Comment:
<!-- Bito Reply -->
The suggestion to apply the `secure_filename` guard in
`superset/sqllab/api.py` is appropriate and improves the code by ensuring
consistent sanitization of user-supplied filenames across both the chart data
and SQL Lab export paths. This change effectively mitigates the identified path
traversal risk by preventing raw input from being used directly in the
Content-Disposition header.
**superset/charts/data/api.py**
```
filename = request.form.get("filename")
+ if filename:
+ # Sanitize the user-supplied filename before it is used in the
+ # Content-Disposition header (consistent with the generated-name
+ # path). secure_filename may reduce a name consisting entirely
of
+ # unsupported characters to an empty string, in which case fall
back
+ # to the generated default downstream.
+ filename = secure_filename(filename) or None
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
