codeant-ai-for-open-source[bot] commented on code in PR #41133:
URL: https://github.com/apache/superset/pull/41133#discussion_r3471265110
##########
superset/dashboards/api.py:
##########
@@ -1375,6 +1385,97 @@ def export_as_example(self, pk: int) -> Response:
response.set_cookie(token, "done", max_age=600)
return response
+ @expose("/<pk>/export_xlsx/", methods=("POST",))
+ @protect()
+ @safe
+ @permission_name("export")
+ @statsd_metrics
+ @event_logger.log_this_with_context(
+ action=lambda self, *args, **kwargs:
f"{self.__class__.__name__}.export_xlsx",
+ log_to_statsd=False,
+ )
+ def export_xlsx(self, pk: int) -> WerkzeugResponse:
+ """Export all of a dashboard's chart data to an Excel workbook (async).
+ ---
+ post:
+ summary: Export dashboard chart data to Excel
+ description: >-
+ Enqueues an async task that writes each chart's data to its own
+ worksheet, uploads the .xlsx to S3, and emails the requesting user
a
+ pre-signed download link. Returns immediately with a job id.
+ parameters:
+ - in: path
+ schema:
+ type: integer
+ name: pk
+ description: The dashboard id
+ requestBody:
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/DashboardExportXlsxPostSchema'
+ responses:
+ 202:
+ description: Export task accepted
+ content:
+ application/json:
+ schema:
+ $ref:
'#/components/schemas/DashboardExportXlsxResponseSchema'
+ 400:
+ $ref: '#/components/responses/400'
+ 401:
+ $ref: '#/components/responses/401'
+ 403:
+ $ref: '#/components/responses/403'
+ 404:
+ $ref: '#/components/responses/404'
+ 500:
+ $ref: '#/components/responses/500'
+ 501:
+ description: Excel export is not configured on this server
+ """
+ if not current_app.config["EXCEL_EXPORT_S3_BUCKET"]:
+ return self.response(
+ 501, message="Excel export is not configured on this server."
+ )
+ try:
+ # Tolerate an empty/non-JSON body (e.g. a POST with no
Content-Type);
+ # request.json would otherwise raise 415.
+ payload = DashboardExportXlsxPostSchema().load(
+ request.get_json(silent=True) or {}
+ )
Review Comment:
**Suggestion:** Using `request.get_json(silent=True)` here causes malformed
JSON bodies to be treated as `{}` and accepted, so clients can send invalid
payloads and still get a `202` export job instead of a `400` validation error.
Parse JSON without `silent=True` (or explicitly detect parse failure) so
syntactically invalid JSON is rejected. [api mismatch]
<details>
<summary><b>Severity Level:</b> Major ⚠️</summary>
```mdx
- ❌ Malformed JSON export requests accepted and jobs enqueued anyway.
- ⚠️ Dashboard filters silently ignored when JSON body malformed.
- ⚠️ Clients cannot reliably detect bad request formatting issues.
```
</details>
<details>
<summary><b>Steps of Reproduction ✅ </b></summary>
```mdx
1. Start Superset with this PR deployed and Excel export configured so that
`EXCEL_EXPORT_S3_BUCKET` is non-empty (checked at
`superset/dashboards/api.py:1378-1380`
in `export_xlsx`).
2. Send an HTTP `POST` to `/api/v1/dashboard/<pk>/export_xlsx/` (the
`export_xlsx`
endpoint defined at `superset/dashboards/api.py:1388-1477`) with header
`Content-Type:
application/json` and a syntactically invalid JSON body (for example, the
single character
`{`).
3. The view function executes the block at
`superset/dashboards/api.py:1442-1446`, where
`request.get_json(silent=True)` returns `None` on JSON parse failure, causing
`DashboardExportXlsxPostSchema().load(request.get_json(silent=True) or {})`
to load `{}`
without raising a `ValidationError`, so the `except ValidationError` block
at `1447-1448`
is never triggered.
4. Execution continues to `export_dashboard_excel.apply_async(...)` at
`superset/dashboards/api.py:1468-1475`, enqueuing an export job with
`active_data_mask`
defaulted to `{}`, and the API responds with HTTP 202 and a `job_id` instead
of failing
fast with a 400 error for the malformed JSON body.
```
</details>
[](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=8d8516e5103e4d419e0bce7c6f74489a&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
[](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=8d8516e5103e4d419e0bce7c6f74489a&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
*(Use Cmd/Ctrl + Click for best experience)*
<details>
<summary><b>Prompt for AI Agent 🤖 </b></summary>
```mdx
This is a comment left during a code review.
**Path:** superset/dashboards/api.py
**Line:** 1444:1446
**Comment:**
*Api Mismatch: Using `request.get_json(silent=True)` here causes
malformed JSON bodies to be treated as `{}` and accepted, so clients can send
invalid payloads and still get a `202` export job instead of a `400` validation
error. Parse JSON without `silent=True` (or explicitly detect parse failure) so
syntactically invalid JSON is rejected.
Validate the correctness of the flagged issue. If correct, How can I resolve
this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask
user if the user wants to fix the rest of the comments as well. if said yes,
then fetch all the comments validate the correctness and implement a minimal fix
```
</details>
<a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F41133&comment_hash=ef261059962c7aa1924ecced212af5cfe48e919218623d53b44659bd069e3b2d&reaction=like'>👍</a>
| <a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F41133&comment_hash=ef261059962c7aa1924ecced212af5cfe48e919218623d53b44659bd069e3b2d&reaction=dislike'>👎</a>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
