codeant-ai-for-open-source[bot] commented on code in PR #41780:
URL: https://github.com/apache/superset/pull/41780#discussion_r3565320514
##########
superset/views/core.py:
##########
@@ -932,6 +933,52 @@ def language_pack(self, lang: str) -> FlaskResponse:
"Language pack doesn't exist on the server", status=404
)
+ @expose("/language_pack/<lang>/<version>/script.js")
+ def language_pack_script(self, lang: str, version: str) -> FlaskResponse:
+ """Serve the language pack as a content-addressed classic script.
+
+ spa.html loads this BEFORE the entry bundle so translations are
+ configured synchronously (no race with code-split chunks), while the
+ versioned URL lets browsers cache the pack as immutable and pick up a
+ fresh copy whenever translations change.
+
+ Deliberately unauthenticated: translation catalogs are static, public
+ content shipped in the Superset repo, contain no user or tenant data,
+ and must load for anonymous principals (login page, embedded).
+ """
+ # Only allow expected language formats like "en", "pt_BR", etc.
+ if not re.match(r"^[a-z]{2,3}(_[A-Z]{2})?$", lang):
+ abort(400, "Invalid language code")
Review Comment:
**Suggestion:** The language-code validation is too restrictive for locales
that Superset actually ships (for example `sr_Latn`), so valid non-English
users can get a 400 from the new versioned script endpoint and silently fall
back to English. Relax this check to accept the locale formats present in your
translation catalog (or validate against known available locales) so
script-based loading works for script-subtag locales too. [incorrect condition
logic]
<details>
<summary><b>Severity Level:</b> Major ⚠️</summary>
```mdx
- ❌ sr_Latn users cannot load translation language pack.
- ⚠️ Affected users silently fall back to English UI.
```
</details>
<details>
<summary><b>Steps of Reproduction ✅ </b></summary>
```mdx
1. Configure Superset with a script-subtag locale such as `sr_Latn`:
- Ensure `LANGUAGES` in `superset_config.py` includes a key `"sr_Latn"`
(per documented
LANGUAGES usage in `docs/.../contributing/howtos.mdx:472-476`).
- Set the Babel locale (via `BABEL_DEFAULT_LOCALE` or user preference) to
`sr_Latn` so
`get_locale()` returns this value when rendering spa pages.
2. Trigger a spa render that uses `common_bootstrap_payload`, for example
the personalized
welcome page:
- Endpoint `Superset.welcome` in `superset/views/core.py` (lines 83-102
in tool output)
calls `common_bootstrap_payload()` from `superset/views/base.py:28-40`
and passes its
result as `payload["common"]` into `render_app_template`.
3. Observe how the locale `sr_Latn` flows into the language pack URL used by
the template:
- In `cached_common_bootstrap_data` (`superset/views/base.py:33-42`),
`locale` is
normalized with `locale.replace("-", "_")`, then `languages =
app.config.get("LANGUAGES")`.
- Because `"sr_Latn"` is both a real translation directory
(`superset/translations/sr_Latn` from `LS`) and a configured language,
the `if
normalized in languages:` branch sets `language = "sr_Latn"`.
- The resulting `bootstrap_data` includes `"locale": language`
(`superset/views/base.py:582-7`), so `common["locale"]` becomes
`"sr_Latn"`.
- `get_language_pack_template_context` in `superset/views/base.py:43-74`
then does:
- `language = common.get("locale")` => `"sr_Latn"`.
- `version = get_language_pack_version(language)` which, via
`superset/translations/utils.py:44-60`, reads
`translations/sr_Latn/LC_MESSAGES/messages.json` and computes a 12-hex
hash.
- Builds `language_pack_src` as
`url_for("Superset.language_pack_script",
lang=language, version=version)` (base.py:64-69), yielding a script tag
pointing at
`/language_pack/sr_Latn/<version>/script.js` in `spa.html`.
4. See the script endpoint reject the valid locale and the app silently fall
back to
English:
- The browser requests `/language_pack/sr_Latn/<version>/script.js`,
which is handled
by `language_pack_script` in `superset/views/core.py:37-81`.
- At the top of this handler, the language-code validation uses `if not
re.match(r"^[a-z]{2,3}(_[A-Z]{2})?$", lang): abort(400, "Invalid language
code")`
(core.py lines 50-52 in tool output; corresponding to diff lines 950-951).
- The locale `"sr_Latn"` from the real translation directory
(`superset/translations/sr_Latn`) does not match the regex
`^[a-z]{2,3}(_[A-Z]{2})?$`
because the script subtag `"Latn"` is four characters and not a 2-letter
region code,
so the endpoint aborts with HTTP 400.
- When the synchronous script load fails, the frontend falls back to the
async JSON
fetch in `superset-frontend/src/preamble.ts:13-27`, which calls
`makeUrl(`/language_pack/${lang}/`)` (preamble.ts:13-15). That hits the
JSON endpoint
`language_pack` in `superset/views/core.py:21-35`, which uses the same
regex `if not
re.match(r"^[a-z]{2,3}(_[A-Z]{2})?$", lang): abort(400, "Invalid language
code")`
(core.py:23-25), so `/language_pack/sr_Latn/` also returns 400.
- The catch block in `preamble.ts` (lines 27-33) logs a warning and calls
`configure()`
with no language pack, then `dayjs.locale('en')`, so the user with locale
`sr_Latn`
sees the UI in English despite a valid `sr_Latn` language pack existing
on disk.
```
</details>
[](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=744be391c26b4830a48440e688d6a588&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
[](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=744be391c26b4830a48440e688d6a588&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
*(Use Cmd/Ctrl + Click for best experience)*
<details>
<summary><b>Prompt for AI Agent 🤖 </b></summary>
```mdx
This is a comment left during a code review.
**Path:** superset/views/core.py
**Line:** 950:951
**Comment:**
*Incorrect Condition Logic: The language-code validation is too
restrictive for locales that Superset actually ships (for example `sr_Latn`),
so valid non-English users can get a 400 from the new versioned script endpoint
and silently fall back to English. Relax this check to accept the locale
formats present in your translation catalog (or validate against known
available locales) so script-based loading works for script-subtag locales too.
Validate the correctness of the flagged issue. If correct, How can I resolve
this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask
user if the user wants to fix the rest of the comments as well. if said yes,
then fetch all the comments validate the correctness and implement a minimal fix
```
</details>
<a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F41780&comment_hash=32bdc83d9dd15094741f8a99f6e9d381eabc8eb5bb04acba4c55e3307f8c362e&reaction=like'>👍</a>
| <a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F41780&comment_hash=32bdc83d9dd15094741f8a99f6e9d381eabc8eb5bb04acba4c55e3307f8c362e&reaction=dislike'>👎</a>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
