rusackas commented on PR #33924: URL: https://github.com/apache/superset/pull/33924#issuecomment-4998969515
Thanks again @sha174n, this was the right call. Pushed a commit (1742bc4) that makes `get_guest_user_attribute` escape string values by default using the dialect's quoting, same as `url_param`, reusing the existing `_escape_value` helper so strings inside lists get escaped element-wise and the other JSON-native types pass through untouched. `escape_result=False` still gets you the raw value if you need it. Added unit tests for both the escaped and unescaped paths, and reworked the docs security note to match the new safe-by-default behavior. The `is_admin` authorization example is already out of the docs, and the "how attributes get set" section landed earlier per @mistercrunch's note. Since you're wearing the security hat here, mind giving it another look when you get a chance? Would love your stamp before we merge. Thanks! -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
