codeant-ai-for-open-source[bot] commented on code in PR #40084:
URL: https://github.com/apache/superset/pull/40084#discussion_r3648339710
##########
superset/extensions/api.py:
##########
@@ -169,7 +169,7 @@ def get(self, publisher: str, name: str, **kwargs: Any) ->
Response:
@protect()
@safe
- @expose("/<publisher>/<name>/<file>", methods=("GET",))
+ @expose("/<publisher>/<name>/<path:file>", methods=("GET",))
Review Comment:
Yes. The extension asset pipeline preserves the relative paths from
`frontend/dist`:
- `FRONTEND_REGEX` now captures the complete path after `frontend/dist/`,
including `/` separators.
- `build_extension_data()` uses that captured path when constructing asset
URLs.
- The API route uses Flask’s `<path:file>` converter, so URLs such as
`/workers/nested/chunk.wasm` are accepted.
- The cache middleware regex was updated to match nested asset paths as well.
Thus a built asset such as:
```text
frontend/dist/workers/nested/chunk.wasm
```
is exposed as:
```text
/api/v1/extensions/<publisher>/<name>/workers/nested/chunk.wasm
```
The existing ZIP safety validation still runs before loading, and the
frontend regex rejects paths containing `..`. The added nested-asset middleware
test covers the cache behavior; it would also be useful to add an end-to-end or
CLI-level fixture containing a nested frontend asset to verify that the
manifest/build output preserves the path exactly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
