codeant-ai-for-open-source[bot] commented on code in PR #41780:
URL: https://github.com/apache/superset/pull/41780#discussion_r3562126825
##########
superset/views/core.py:
##########
@@ -932,6 +933,48 @@ def language_pack(self, lang: str) -> FlaskResponse:
"Language pack doesn't exist on the server", status=404
)
+ @expose("/language_pack/<lang>/<version>/script.js")
+ def language_pack_script(self, lang: str, version: str) -> FlaskResponse:
+ """Serve the language pack as a content-addressed classic script.
+
+ spa.html loads this BEFORE the entry bundle so translations are
+ configured synchronously (no race with code-split chunks), while the
+ versioned URL lets browsers cache the pack as immutable and pick up a
+ fresh copy whenever translations change.
+
+ Deliberately unauthenticated: translation catalogs are static, public
+ content shipped in the Superset repo, contain no user or tenant data,
+ and must load for anonymous principals (login page, embedded).
+ """
+ # Only allow expected language formats like "en", "pt_BR", etc.
+ if not re.match(r"^[a-z]{2,3}(_[A-Z]{2})?$", lang):
+ abort(400, "Invalid language code")
+ if not re.match(r"^[0-9a-f]{12}$", version):
+ abort(400, "Invalid language pack version")
+
+ current_version = get_language_pack_version(lang)
+ pack = get_language_pack(lang)
+ if current_version is None or pack is None:
Review Comment:
**Suggestion:** The new unauthenticated endpoint always calls both version
and pack loaders before checking whether the locale exists. For nonexistent
locales, `get_language_pack_version` already returns `None`, but
`get_language_pack` still runs, performs extra file I/O, falls back to English,
and logs errors. This creates avoidable work and log amplification on a public
route. Short-circuit immediately when the version lookup is `None`, and only
load the pack for existing locales. [performance]
<details>
<summary><b>Severity Level:</b> Major ⚠️</summary>
```mdx
- ⚠️ Extra disk I/O for missing-locale language_pack_script requests.
- ⚠️ Unnecessary warning and error logs on public endpoint.
- ⚠️ Potential log noise under automated or malformed traffic.
```
</details>
<details>
<summary><b>Steps of Reproduction ✅ </b></summary>
```mdx
1. Start the Superset web server with this PR code so that the Superset view
blueprint
(class containing language_pack_script) in `superset/views/core.py:37-77` is
registered.
2. Send an HTTP GET request to the `Superset.language_pack_script` route
with a
syntactically valid but unsupported locale, for example `GET
/superset/language_pack/xx/aaaaaaaaaaaa/script.js`, where `xx` matches the
locale regex
and `aaaaaaaaaaaa` matches the version regex (see
`superset/views/core.py:50-54`).
3. In `language_pack_script` at `superset/views/core.py:56`, the code calls
`get_language_pack_version(lang)`. For the nonexistent locale `xx`,
`get_language_pack_version` in `superset/translations/utils.py:15-31`
computes a filename,
attempts to open it, raises `OSError`, logs a warning (`logger.warning("No
language pack
file to version for locale %s", locale)`), and returns `None`.
4. Despite `current_version` being `None`, `language_pack_script`
immediately calls
`get_language_pack(lang)` at `superset/views/core.py:57`.
`get_language_pack` in
`superset/translations/utils.py:34-54` again resolves the same nonexistent
file, attempts
to open it, logs an error and falls back to `get_language_pack("en")`,
performing extra
file I/O and logging. Finally, back in `language_pack_script`, the check `if
current_version is None or pack is None:` at `superset/views/core.py:58-61`
evaluates true
because `current_version` is `None`, and the endpoint returns a 404 JSON
error. The extra
pack loading and logging on this unauthenticated public route are
unnecessary for all such
missing-locale requests and would be avoided by short-circuiting when
`current_version` is
`None`.
```
</details>
[](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=7a225ccd97114de8a7cdaf547f4628e7&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
[](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=7a225ccd97114de8a7cdaf547f4628e7&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
*(Use Cmd/Ctrl + Click for best experience)*
<details>
<summary><b>Prompt for AI Agent 🤖 </b></summary>
```mdx
This is a comment left during a code review.
**Path:** superset/views/core.py
**Line:** 955:957
**Comment:**
*Performance: The new unauthenticated endpoint always calls both
version and pack loaders before checking whether the locale exists. For
nonexistent locales, `get_language_pack_version` already returns `None`, but
`get_language_pack` still runs, performs extra file I/O, falls back to English,
and logs errors. This creates avoidable work and log amplification on a public
route. Short-circuit immediately when the version lookup is `None`, and only
load the pack for existing locales.
Validate the correctness of the flagged issue. If correct, How can I resolve
this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask
user if the user wants to fix the rest of the comments as well. if said yes,
then fetch all the comments validate the correctness and implement a minimal fix
```
</details>
<a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F41780&comment_hash=818a35fdaa3ac5bae0130ac9e8ff71fc753e79584500d7e6c735a08728a7533b&reaction=like'>👍</a>
| <a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F41780&comment_hash=818a35fdaa3ac5bae0130ac9e8ff71fc753e79584500d7e6c735a08728a7533b&reaction=dislike'>👎</a>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
